rework error alerts

.gitignore

@@ -2,7 +2,6 @@ dist
 **/node_modules
 src-tauri/target/
 **/creddy.db
-
-# just in case
-credentials*
-!credentials.rs
+# .env is system-specific
+.env
+.vscode

doc/security.md

@@ -9,7 +9,7 @@ The following is a list of security features that I hope to add eventually, in a
 * To defend against the possibility that an attacker could replace, say, the `aws` executable with a malicious one that snarfs your credentials and then passes the command on to the real one, maybe track the path (and maybe even the hash) of the executable, and raise a warning if this is the first time we've seen that one? Using the hash would be safer, but would also introduce a lot of false positives, since every time the application gets updated it would trigger. On the other hand, users should presumably know when they've updated things, so maybe it would be ok. On the _other_ other hand, if somebody doesn't use `aws` very often then it might be weeks or months in between updating it and actually using the updated executable, in which case they probably won't remember that this is the first time they've used it since updating.  
 Another possible approach is to _watch_ the files in question, and alert the user whenever any of them changes. Presumably the user will know whether this change is expected or not.
 * Downgrade privileges after launching. In particular, if possible, disallow any kind of outgoing network access (obviously we have to bind the listening socket, but maybe we can filter that down to _just_ the ability to bind that particular address/port) and filesystem access outside of state db. I think this is doable on Linux, although it may involve high levels of `seccomp` grossness. No idea whether it's possible on Windows. Probably possible on MacOS although it may require lengths to which I am currently unwilling to go (e.g. pay for a certificate from Apple or something.)
-* "Panic button" - if a potential attack is detected (e.g. the user denies a request but Creddy discovers the request has already succeeded somehow), offer a one-click option to lock out the current IAM user. (Sadly, you can't revoke session tokens, so this is the only way to limit a potential compromise). Not sure how feasible this is, session credentials may be limited with regard to what kind of IAM operations they can carry out.)
+* "Panic button" - if a potential attack is detected (e.g. the user denies a request but Creddy discovers the request has already succeeded somehow), offer a one-click option to lock out the current IAM user. Sadly, you can't revoke session tokens, so this is the only way to limit a potential compromise. Obviously this would require the current user having the ability to revoke their own IAM permissions.)
 * Some kind of Yubikey or other HST integration. (Optional, since not everyone will have a HST.) This comes in two flavors:
     1. (Probably doable) Store the encryption key for the passphrase on the HST, and ask the HST to decrypt the passphrase instead of asking the user to enter it. This has the advantage of being a) lower-friction, since the user doesn't have to type in the passphrase, and b) more secure, since the application code never sees the encryption key.
     2. (Less doable) Store the actual AWS secret key on the HST, and then ask the HST to just sign the whole `GetSessionToken` request. This requires that the HST support the exact signing algorithm required by AWS, which a) it probably doesn't, and b) is subject to change anyway. So this is probably not doable, but it's worth at least double-checking, since it would provide the maximum theoretical level of security. (That is, after initial setup, the application would never again see the long-lived AWS secret key.)
@@ -19,9 +19,9 @@ Another possible approach is to _watch_ the files in question, and alert the use
 
 Who exactly are we defending against and why?
 
-The basic idea behind Creddy is that it provides "gap coverage" between two wildly different security boundaries: 1) the older, user-based model, where all code executing as a given user is assumed to have the same level of trust, and 2) the newer, application-based model (most clearly seen on mobile devices) where that bondary instead exists around each _application_. 
+The basic idea behind Creddy is that it provides "gap coverage" between two wildly different security models: 1) the older, user-based model, where all code executing as a given user is assumed to have the same level of trust, and 2) the newer, application-based model (most clearly seen on mobile devices) where that bondary instead exists around each _application_. 
 
-The unfortunate reality is that desktop environments are unlikely to adopt the latter model any time soon, if ever. This is primarily due to friction: Per-application security is a nightmare to manage. The only reason it works at all on mobile devices is because most mobile apps eschew the local device in favor of cloud-backed services where they can, e.g. for file storage. Arguably, the higher-friction trust model of mobile environments is in part _why_ mobile apps tend to be cloud-first.
+The unfortunate reality is that desktop environments are unlikely to adopt the latter model any time soon, if ever. This is primarily due to friction: Per-application security is a nightmare to manage. The only reason it works at all on mobile devices is because most mobile apps eschew the local device in favor of cloud-backed services where they can, e.g. for file storage. Arguably, the higher-friction trust model of mobile environments (along with the frequently-replaced nature of mobile devices) is in part _why_ mobile apps tend to be cloud-first.
 
 Regardless, we live in a world where it's difficult to run untrusted code without giving it an inordinate level of access to the machine on which it runs. Creddy attempts to prevent that access from including your AWS credentials. The threat model is thus "untrusted code running under your user". This is especially likely to occur in the form of a supply-chain attack, where the compromised code is not your own but rather a dependency, or a dependency of a dependency, etc.
 
@@ -31,13 +31,13 @@ There are lots of ways that I can imagine someone might try to circumvent Creddy
 
 ### Tricking Creddy into allowing a request that it shouldn't
 
-If an attacker is able to compromise Creddy's frontend, e.g. via a JS library that Creddy relies on, they could forge "request accepted" responses and cause the backend to hand out credentials to an unauthorized client. Most likely, the user would immediately be alerted to the fact that Something Is Up because as soon as the request came in, Creddy would pop up requesting permission. When the user (presumably) denied the request, Creddy would discover that the request had already been approved - we could make this a high-alert situation because it would be unlikely to happen unless something fishy were going on. Additionally, the request and (hopefully) what executable made it would be logged.
+If an attacker is able to compromise Creddy's frontend, e.g. via a JS library that Creddy relies on, they could forge "request accepted" responses and cause the backend to hand out credentials to an unauthorized client. Most likely, the user would immediately be alerted to the fact that Something Is Up because Creddy would pop up requesting then permission, and then immediately disappear again because the request had been approved. Additionally, the request and (hopefully) what executable made it would be logged.
 
 ### Tricking the user into allowing a request they didn't intend to
 
-If an attacker can edit the user's .bashrc or similar, they could theoretically insert a function or pre-command hook that wraps, say, the `aws` command, and dump the credentials before continuing on with the user's command. This would most likely alert the user because either a) the attacker is hijacking the original `aws` command and thus it doesn't do what the user told it to, or b) the user's original `aws` command proceeds as normal after the malicious one, and the user is alerted by the second request where there should only have been one.
+If an attacker can edit the user's .bashrc or similar, they could theoretically insert a function or pre-command hook that wraps, say, the `aws` command, and dump the credentials before continuing on with the user's command. The attacker could inject the credentials into the environment before running the original command, so as to avoid alerting the user by issuing a second credentials request.
 
-A similar but more-difficult-to-detect attack would be replacing the `aws` executable, or any other executable that is always expected to ask for AWS credentials, with a malicious wrapper that snarfs the credentials before passing them through to the original command. Creddy could defend against this to a certain extent by storing the hash of the executable, as discussed above.
+Another attack along the same lines would be replacing the `aws` executable, or any other executable that is always expected to ask for AWS credentials, with a malicious wrapper that snarfs the credentials before passing them through to the original command. Creddy could defend against this to a certain extent by storing the hash of the executable, as discussed above.
 
 ### Pretending to be the user
 
@@ -46,3 +46,5 @@ Most desktop environments don't prevent applications from simulating user-input
 ### Twiddling with Creddy's persistent state
 
 The solutions to or mitigations for a lot of these attacks rely on Creddy being able to assume that its local database hasn't been tampered with. Unfortunately, given that our threat model is "other code running as the same user", this isn't a safe assumption.
+
+The solution to this problem is probably just to encrypt the entire database. This introduces a bit of complexity since certain settings, like `start_on_login` and `start_minimized`, will need to be accessible before the app is unlocked,but these settings can probably just be stashed alongside the database and kept in sync on every config save.

doc/todo.md

@@ -1,13 +1,18 @@
 ## Definitely
 
-* Switch to "process" provider for AWS credentials (much less hacky)
-* Session timeout (plain duration, or activity-based?)
-* ~Fix rehide behavior when new request comes in while old one is still being resolved~
+* ~~Switch to "process" provider for AWS credentials (much less hacky)~~
+* ~~Frontend needs to react when request is cancelled from backend~~
+* ~~Session timeout~~
+* ~~Fix rehide behavior when new request comes in while old one is still being resolved~~
+* ~~Switch tray menu item to Hide when window is visible~~
+* Clear password input after unlock fails
+* Indicate on approval screen when additional requests are pending
 * Additional hotkey configuration (approve/deny at the very least)
 * Logging
 * Icon
 * Auto-updates
 * SSH key handling
+* Encrypted sync server
 
 ## Maybe
 
@@ -17,3 +22,4 @@
 * Make hotkey configuration a little more tolerant of slight mistiming
 * Distinguish between request that was denied and request that was canceled (e.g. due to error)
 * Use atomic types for primitive state values instead of RwLock'd types
+* Rework approval flow to be a fullscreen overlay instead of mixing with normal navigation (as more views are added the pain of the current situation will only increase)

index.html

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html lang="en" data-theme="dark">
+<html lang="en" data-theme="creddy">
   <head>
     <meta charset="UTF-8" />
     <link rel="icon" type="image/svg+xml" href="/vite.svg" />

package.json

@@ -1,6 +1,6 @@
 {
   "name": "creddy",
-  "version": "0.3.3",
+  "version": "0.4.9",
   "scripts": {
     "dev": "vite",
     "build": "vite build",
@@ -9,7 +9,7 @@
   },
   "devDependencies": {
     "@sveltejs/vite-plugin-svelte": "^1.0.1",
-    "@tauri-apps/cli": "^1.0.5",
+    "@tauri-apps/cli": "^2.0.0-beta.20",
     "autoprefixer": "^10.4.8",
     "postcss": "^8.4.16",
     "svelte": "^3.49.0",
@@ -17,7 +17,9 @@
     "vite": "^3.0.7"
   },
   "dependencies": {
-    "@tauri-apps/api": "^1.0.2",
-    "daisyui": "^2.51.5"
+    "@tauri-apps/api": "^2.0.0-beta.13",
+    "@tauri-apps/plugin-dialog": "^2.0.0-beta.5",
+    "@tauri-apps/plugin-os": "^2.0.0-beta.5",
+    "daisyui": "^4.12.8"
   }
 }

src-tauri/.env

@@ -1 +0,0 @@
-DATABASE_URL=sqlite://C:/Users/Joe/AppData/Roaming/creddy/creddy.dev.db

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "creddy"
-version = "0.3.3"
+version = "0.4.9"
 description = "A friendly AWS credentials manager"
 authors = ["Joseph Montanaro"]
 license = ""
@@ -20,21 +20,19 @@ path = "src/main.rs"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [build-dependencies]
-tauri-build = { version = "1.0.4", features = [] }
+tauri-build = { version = "2.0.0-beta", features = [] }
 
 [dependencies]
 serde_json = "1.0"
 serde = { version = "1.0", features = ["derive"] }
-tauri = { version = "1.2", features = ["dialog", "dialog-open", "global-shortcut", "os-all", "system-tray"] }
-tauri-plugin-single-instance = { git = "https://github.com/tauri-apps/plugins-workspace", branch = "dev" }
+tauri = { version = "2.0.0-beta", features = ["tray-icon"] }
 sodiumoxide = "0.2.7"
 tokio = { version = ">=1.19", features = ["full"] }
-sqlx = { version = "0.6.2", features = ["sqlite", "runtime-tokio-rustls"] }
 sysinfo = "0.26.8"
-aws-types = "0.52.0"
-aws-sdk-sts = "0.22.0"
-aws-smithy-types = "0.52.0"
-aws-config = "0.52.0"
+aws-config = "1.5.3"
+aws-types = "1.3.2"
+aws-sdk-sts = "1.33.0"
+aws-smithy-types = "1.2.0"
 thiserror = "1.0.38"
 once_cell = "1.16.0"
 strum = "0.24"
@@ -47,6 +45,15 @@ argon2 = { version = "0.5.0", features = ["std"] }
 chacha20poly1305 = { version = "0.10.1", features = ["std"] }
 which = "4.4.0"
 windows = { version = "0.51.1", features = ["Win32_Foundation", "Win32_System_Pipes"] }
+time = "0.3.31"
+tauri-plugin-single-instance = "2.0.0-beta.9"
+tauri-plugin-global-shortcut = "2.0.0-beta.6"
+rfd = "0.14.1"
+ssh-agent-lib = "0.4.0"
+ssh-key = { version = "0.6.6", features = ["rsa", "ed25519", "encryption"] }
+signature = "2.2.0"
+tokio-stream = "0.1.15"
+sqlx = { version = "0.7.4", features = ["sqlite", "runtime-tokio", "uuid"] }
 
 [features]
 # by default Tauri runs in production mode

src-tauri/capabilities/migrated.json

@@ -0,0 +1,17 @@
+{
+  "identifier": "migrated",
+  "description": "permissions that were migrated from v1",
+  "local": true,
+  "windows": [
+    "main"
+  ],
+  "permissions": [
+    "path:default",
+    "event:default",
+    "window:default",
+    "app:default",
+    "resources:default",
+    "menu:default",
+    "tray:default"
+  ]
+}

src-tauri/gen/schemas/capabilities.json

@@ -0,0 +1 @@
+{"migrated":{"identifier":"migrated","description":"permissions that were migrated from v1","local":true,"windows":["main"],"permissions":["path:default","event:default","window:default","app:default","resources:default","menu:default","tray:default"]}}

src-tauri/migrations/20240612192956_kv.sql

@@ -0,0 +1,11 @@
+-- key-value store, will be used for various one-off values, serialized to bytes
+CREATE TABLE kv (
+    name TEXT PRIMARY KEY,
+    value BLOB
+);
+
+-- config is currently stored in its own table, as text
+INSERT INTO kv (name, value)
+SELECT 'config', CAST(data AS BLOB) FROM config;
+
+DROP TABLE config;

src-tauri/migrations/20240617142724_credential_split.sql

@@ -0,0 +1,77 @@
+-- app structure is changing - instead of passphrase/salt being per credential,
+-- we now have a single app-wide key, which is generated by hashing the passphrase
+-- with the known salt. To verify the key thus produced, we store a value previously
+-- encrypted with that key, and attempt decryption once the key has been re-generated.
+
+-- For migration purposes, we want convert the passphrase for the most recent set of
+-- AWS credentials and turn it into the app-wide passphrase. The only value that we
+-- have which is encrypted with that passphrase is the secret key for those credentials,
+-- so we will just use that as the `verify_blob`. Feels a little weird, but oh well.
+WITH latest_creds AS (
+    SELECT *
+    FROM credentials
+    ORDER BY created_at DESC
+    LIMIT 1
+)
+
+INSERT INTO kv (name, value)
+SELECT 'salt', salt FROM latest_creds
+UNION ALL
+SELECT 'verify_nonce', nonce FROM latest_creds
+UNION ALL
+SELECT 'verify_blob', secret_key_enc FROM latest_creds;
+
+
+-- Credentials are now going to be stored in a main table
+-- plus ancillary tables for type-specific data
+
+-- stash existing AWS creds in temporary table so that we can remake it
+CREATE TABLE aws_tmp (id, access_key_id, secret_key_enc, nonce, created_at);
+
+INSERT INTO aws_tmp 
+SELECT randomblob(16), access_key_id, secret_key_enc, nonce, created_at
+FROM credentials
+ORDER BY created_at DESC
+-- we only ever used one at a time in the past
+LIMIT 1;
+
+-- new master credentials table
+DROP TABLE credentials;
+CREATE TABLE credentials (
+    -- id is a UUID so we can generate it on the frontend
+    id BLOB UNIQUE NOT NULL,
+    name TEXT UNIQUE NOT NULL,
+    credential_type TEXT NOT NULL,
+    is_default BOOLEAN NOT NULL,
+    created_at INTEGER NOT NULL
+);
+
+-- populate with basic data from existing AWS credential
+INSERT INTO credentials (id, name, credential_type, is_default, created_at)
+SELECT id, 'default', 'aws', 1, created_at FROM aws_tmp;
+
+-- new AWS-specific table
+CREATE TABLE aws_credentials (
+    id BLOB UNIQUE NOT NULL,
+    access_key_id TEXT NOT NULL,
+    secret_key_enc BLOB NOT NULL,
+    nonce BLOB NOT NULL,
+    FOREIGN KEY(id) REFERENCES credentials(id) ON DELETE CASCADE
+);
+
+-- populate with AWS-specific data from existing credential
+INSERT INTO aws_credentials (id, access_key_id, secret_key_enc, nonce)
+SELECT id, access_key_id, secret_key_enc, nonce
+FROM aws_tmp;
+
+-- done with this now
+DROP TABLE aws_tmp;
+
+
+-- SSH keys are the new hotness
+CREATE TABLE ssh_keys (
+    name TEXT UNIQUE NOT NULL,
+    public_key BLOB NOT NULL,
+    private_key_enc BLOB NOT NULL,
+    nonce BLOB NOT NULL
+);

src-tauri/src/_credentials.rs

@@ -126,23 +126,31 @@ impl LockedCredentials {
         let secret_access_key = String::from_utf8(decrypted)
             .map_err(|_| UnlockError::InvalidUtf8)?;
 
-        let creds = BaseCredentials {
-            access_key_id: self.access_key_id.clone(),
+        let creds = BaseCredentials::new(
+            self.access_key_id.clone(),
             secret_access_key,
-        };
+        );
         Ok(creds)
     }
 }
 
 
+fn default_credentials_version() -> usize { 1 }
+
 #[derive(Clone, Debug, Serialize, Deserialize)]
 #[serde(rename_all = "PascalCase")]
 pub struct BaseCredentials {
+    #[serde(default = "default_credentials_version")]
+    pub version: usize,
     pub access_key_id: String,
     pub secret_access_key: String,
 }
 
 impl BaseCredentials {
+    pub fn new(access_key_id: String, secret_access_key: String) -> Self {
+        Self {version: 1, access_key_id, secret_access_key}
+    }
+
     pub fn encrypt(&self, passphrase: &str) -> Result<LockedCredentials, CryptoError> {
         let salt = Crypto::salt();
         let crypto = Crypto::new(passphrase, &salt)?;
@@ -162,6 +170,7 @@ impl BaseCredentials {
 #[derive(Clone, Debug, Serialize, Deserialize)]
 #[serde(rename_all = "PascalCase")]
 pub struct SessionCredentials {
+    #[serde(default = "default_credentials_version")]
     pub version: usize,
     pub access_key_id: String,
     pub secret_access_key: String,

src-tauri/src/app.rs

@@ -1,6 +1,11 @@
 use std::error::Error;
+use std::time::Duration;
 
 use once_cell::sync::OnceCell;
+use rfd::{
+    MessageDialog,
+    MessageLevel,
+};
 use sqlx::{
     SqlitePool,
     sqlite::SqlitePoolOptions,
@@ -9,16 +14,20 @@ use sqlx::{
 use tauri::{
     App,
     AppHandle,
-    Manager,
     async_runtime as rt,
+    Manager,
+    RunEvent,
+    WindowEvent,
 };
+use tauri::menu::MenuItem;
 
 use crate::{
     config::{self, AppConfig},
-    credentials::Session,
+    credentials::AppSession,
     ipc,
     server::Server,
     errors::*,
+    shortcuts,
     state::AppState,
     tray,
 };
@@ -30,32 +39,46 @@ pub static APP: OnceCell<AppHandle> = OnceCell::new();
 pub fn run() -> tauri::Result<()> {
     tauri::Builder::default()
         .plugin(tauri_plugin_single_instance::init(|app, _argv, _cwd| {
-            app.get_window("main")
-                .map(|w| w.show().error_popup("Failed to show main window"));
+            show_main_window(app)
+                .error_popup("Failed to show main window")
         }))
-        .system_tray(tray::create())
-        .on_system_tray_event(tray::handle_event)
+        .plugin(tauri_plugin_global_shortcut::Builder::default().build())
         .invoke_handler(tauri::generate_handler![
             ipc::unlock,
+            ipc::lock,
+            ipc::reset_session,
+            ipc::set_passphrase,
             ipc::respond,
             ipc::get_session_status,
-            ipc::save_credentials,
+            ipc::signal_activity,
+            ipc::save_credential,
+            ipc::delete_credential,
+            ipc::list_credentials,
             ipc::get_config,
             ipc::save_config,
             ipc::launch_terminal,
             ipc::get_setup_errors,
+            ipc::exit,
         ])
-        .setup(|app| rt::block_on(setup(app)))
+        .setup(|app| {
+            let res = rt::block_on(setup(app));
+            if let Err(ref e) = res {
+                MessageDialog::new()
+                    .set_level(MessageLevel::Error)
+                    .set_title("Creddy failed to start")
+                    .set_description(format!("{e}"))
+                    .show();
+            }
+            res
+        })
         .build(tauri::generate_context!())?
-        .run(|app, run_event| match run_event {
-            tauri::RunEvent::WindowEvent { label, event, .. } => match event {
-                tauri::WindowEvent::CloseRequested { api, .. } => {
-                    let _ = app.get_window(&label).map(|w| w.hide());
+        .run(|app, run_event| {
+            if let RunEvent::WindowEvent { event, .. } = run_event {
+                if let WindowEvent::CloseRequested { api, .. } = event {
+                    let _ = hide_main_window(app);
                     api.prevent_close();
                 }
-                _ => ()
             }
-            _ => ()
         });
 
     Ok(())
@@ -74,16 +97,16 @@ pub async fn connect_db() -> Result<SqlitePool, SetupError> {
 
 
 async fn setup(app: &mut App) -> Result<(), Box<dyn Error>> {
-    APP.set(app.handle()).unwrap();
-
+    APP.set(app.handle().clone()).unwrap();
+    tray::setup(app)?;
     // get_or_create_db_path doesn't create the actual db file, just the directory
     let is_first_launch = !config::get_or_create_db_path()?.exists();
     let pool = connect_db().await?;
     let mut setup_errors: Vec<String> = vec![];
 
-    let conf = match AppConfig::load(&pool).await {
+    let mut conf = match AppConfig::load(&pool).await {
         Ok(c) => c,
-        Err(SetupError::ConfigParseError(_)) => {
+        Err(LoadKvError::Invalid(_)) => {
             setup_errors.push(
                 "Could not load configuration from database. Reverting to defaults.".into()
             );
@@ -92,25 +115,79 @@ async fn setup(app: &mut App) -> Result<(), Box<dyn Error>> {
         err => err?,
     };
 
-    let session = Session::load(&pool).await?;
-    Server::start(app.handle())?;
+    let app_session = AppSession::load(&pool).await?;
+    Server::start(app.handle().clone())?;
 
     config::set_auto_launch(conf.start_on_login)?;
     if let Err(_e) = config::set_auto_launch(conf.start_on_login) {
         setup_errors.push("Error: Failed to manage autolaunch.".into());
     }
-    if let Err(e) = config::register_hotkeys(&conf.hotkeys) {
-        setup_errors.push(format!("{e}"));
+
+    // if hotkeys fail to register, disable them so that this error doesn't have to keep showing up
+    if let Err(_e) = shortcuts::register_hotkeys(&conf.hotkeys) {
+        conf.hotkeys.disable_all();
+        conf.save(&pool).await?;
+        setup_errors.push("Failed to register hotkeys. Hotkey settings have been disabled.".into());
     }
 
-    // if session is empty, this is probably the first launch, so don't autohide
+    let desktop_is_gnome = std::env::var("XDG_CURRENT_DESKTOP")
+        .map(|names| names.split(':').any(|n| n == "GNOME"))
+        .unwrap_or(false);
+
     if !conf.start_minimized || is_first_launch {
-        app.get_window("main")
-            .ok_or(HandlerError::NoMainWindow)?
-            .show()?;
+        show_main_window(&app.handle())?;
     }
 
-    let state = AppState::new(conf, session, pool, setup_errors);
+    let state = AppState::new(conf, app_session, pool, setup_errors, desktop_is_gnome);
     app.manage(state);
+
+    // make sure we do this after managing app state, so that it doesn't panic
+    start_auto_locker(app.app_handle().clone());
+
     Ok(())
 }
+
+
+fn start_auto_locker(app: AppHandle) {
+    rt::spawn(async move {
+        let state = app.state::<AppState>();
+        loop {
+            // this gives our session-timeout a minimum resolution of 10s, which seems fine?
+            let delay = Duration::from_secs(10);
+            tokio::time::sleep(delay).await;
+
+            if state.should_auto_lock().await {
+                state.lock().await.error_popup("Failed to lock Creddy");
+            }
+        }
+    });
+}
+
+
+pub fn show_main_window(app: &AppHandle) -> Result<(), WindowError> {
+    let w = app.get_webview_window("main").ok_or(WindowError::NoMainWindow)?;
+    w.show()?;
+    let show_hide = app.state::<MenuItem<tauri::Wry>>();
+    show_hide.set_text("Hide")?;
+    Ok(())
+}
+
+
+pub fn hide_main_window(app: &AppHandle) -> Result<(), WindowError> {
+    let w = app.get_webview_window("main").ok_or(WindowError::NoMainWindow)?;
+    w.hide()?;
+    let show_hide = app.state::<MenuItem<tauri::Wry>>();
+    show_hide.set_text("Show")?;
+    Ok(())
+}
+
+
+pub fn toggle_main_window(app: &AppHandle) -> Result<(), WindowError> {
+    let w = app.get_webview_window("main").ok_or(WindowError::NoMainWindow)?;
+    if w.is_visible()? {
+        hide_main_window(app)
+    }
+    else {
+        show_main_window(app)
+    }
+}

src-tauri/src/bin/agent.rs

@@ -0,0 +1,7 @@
+use creddy::server::ssh_agent;
+
+
+#[tokio::main]
+async fn main() {
+    ssh_agent::run().await;
+}

src-tauri/src/bin/creddy_cli.rs

@@ -21,7 +21,8 @@ fn main() {
         None | Some(("run", _)) => launch_gui(),
         Some(("get", m)) => cli::get(m),
         Some(("exec", m)) => cli::exec(m),
-        _ => unreachable!(),
+        Some(("shortcut", m)) => cli::invoke_shortcut(m),
+        _ => unreachable!("Unknown subcommand"),
     };
 
     if let Err(e) = res {

src-tauri/src/bin/key.rs

@@ -0,0 +1,13 @@
+use ssh_key::private::PrivateKey;
+
+
+fn main() {
+    // let passphrase = std::env::var("PRIVKEY_PASSPHRASE").unwrap();
+    let p = AsRef::<std::path::Path>::as_ref("/home/joe/.ssh/test");
+    let privkey = PrivateKey::read_openssh_file(p)
+        .unwrap();
+        // .decrypt(passphrase.as_bytes())
+        // .unwrap();
+
+    dbg!(String::from_utf8_lossy(&privkey.to_bytes().unwrap()));
+}

src-tauri/src/cli.rs

@@ -1,23 +1,24 @@
 use std::ffi::OsString;
 use std::process::Command as ChildCommand;
+#[cfg(windows)]
 use std::time::Duration;
 
 use clap::{
     Command,
-     Arg,
-     ArgMatches,
-     ArgAction
+    Arg,
+    ArgMatches,
+    ArgAction,
+    builder::PossibleValuesParser,
  };
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 
-use crate::credentials::Credentials;
 use crate::errors::*;
 use crate::server::{Request, Response};
+use crate::shortcuts::ShortcutAction;
 
 #[cfg(unix)]
 use {
     std::os::unix::process::CommandExt,
-    std::path::Path,
     tokio::net::UnixStream,
 };
 
@@ -63,14 +64,25 @@ pub fn parser() -> Command<'static> {
                         .multiple_values(true)
                 )
         )
+        .subcommand(
+            Command::new("shortcut")
+                .about("Invoke an action normally trigged by hotkey (e.g. launch terminal)")
+                .arg(
+                    Arg::new("action")
+                        .value_parser(
+                            PossibleValuesParser::new(["show_window", "launch_terminal"])
+                        )
+                )
+        )
 }
 
 
 pub fn get(args: &ArgMatches) -> Result<(), CliError> {
     let base = args.get_one("base").unwrap_or(&false);
-    let output = match get_credentials(*base)? {
-        Credentials::Base(creds) => serde_json::to_string(&creds).unwrap(),
-        Credentials::Session(creds) => serde_json::to_string(&creds).unwrap(),
+    let output = match make_request(&Request::GetAwsCredentials { base: *base })? {
+        Response::AwsBase(creds) => serde_json::to_string(&creds).unwrap(),
+        Response::AwsSession(creds) => serde_json::to_string(&creds).unwrap(),
+        r => return Err(RequestError::Unexpected(r).into()),
     };
     println!("{output}");
     Ok(())
@@ -86,16 +98,17 @@ pub fn exec(args: &ArgMatches) -> Result<(), CliError> {
     let mut cmd = ChildCommand::new(cmd_name);
     cmd.args(cmd_line);
     
-    match get_credentials(base)? {
-        Credentials::Base(creds) => {
+    match make_request(&Request::GetAwsCredentials { base })? {
+        Response::AwsBase(creds) => {
             cmd.env("AWS_ACCESS_KEY_ID", creds.access_key_id);
             cmd.env("AWS_SECRET_ACCESS_KEY", creds.secret_access_key);
         },
-        Credentials::Session(creds) => {
+        Response::AwsSession(creds) => {
             cmd.env("AWS_ACCESS_KEY_ID", creds.access_key_id);
             cmd.env("AWS_SECRET_ACCESS_KEY", creds.secret_access_key);
             cmd.env("AWS_SESSION_TOKEN", creds.session_token);
-        }
+        },
+        r => return Err(RequestError::Unexpected(r).into()),
     }
 
     #[cfg(unix)]
@@ -129,10 +142,25 @@ pub fn exec(args: &ArgMatches) -> Result<(), CliError> {
 }
 
 
+pub fn invoke_shortcut(args: &ArgMatches) -> Result<(), CliError> {
+    let action = match args.get_one::<String>("action").map(|s| s.as_str()) {
+        Some("show_window") => ShortcutAction::ShowWindow,
+        Some("launch_terminal") => ShortcutAction::LaunchTerminal,
+        Some(&_) | None => unreachable!("Unknown shortcut action"), // guaranteed by clap
+    };
+
+    let req = Request::InvokeShortcut(action);
+    match make_request(&req) {
+        Ok(Response::Empty) => Ok(()),
+        Ok(r) => Err(RequestError::Unexpected(r).into()),
+        Err(e) => Err(e.into()),
+    }
+}
+
+
 #[tokio::main]
-async fn get_credentials(base: bool) -> Result<Credentials, RequestError> {
-    let req = Request::GetAwsCredentials { base };
-    let mut data = serde_json::to_string(&req).unwrap();
+async fn make_request(req: &Request) -> Result<Response, RequestError> {
+    let mut data = serde_json::to_string(req).unwrap();
     // server expects newline marking end of request
     data.push('\n');
 
@@ -142,12 +170,7 @@ async fn get_credentials(base: bool) -> Result<Credentials, RequestError> {
     let mut buf = Vec::with_capacity(1024);
     stream.read_to_end(&mut buf).await?;
     let res: Result<Response, ServerError> = serde_json::from_slice(&buf)?;
-    match res {
-        Ok(Response::Aws(creds)) => Ok(creds),
-        // Eventually we will want this
-        // Ok(r) => Err(RequestError::Unexpected(r)),
-        Err(e) => Err(RequestError::Server(e)),
-    }
+    Ok(res?)
 }
 
 
@@ -167,7 +190,5 @@ async fn connect() -> Result<NamedPipeClient, std::io::Error> {
 
 #[cfg(unix)]
 async fn connect() -> Result<UnixStream, std::io::Error> {
-    let path = Path::from("/tmp/creddy-requests");
-    std::fs::remove_file(path)?;
-    UnixStream::connect(path)
+    UnixStream::connect("/tmp/creddy.sock").await
 }

src-tauri/src/clientinfo.rs

@@ -2,19 +2,6 @@ use std::path::{Path, PathBuf};
 
 use sysinfo::{System, SystemExt, Pid, PidExt, ProcessExt};
 use serde::{Serialize, Deserialize};
-use std::os::windows::io::AsRawHandle;
-
-#[cfg(windows)]
-use {
-    tokio::net::windows::named_pipe::NamedPipeServer,
-    windows::Win32::{
-        Foundation::HANDLE,
-        System::Pipes::GetNamedPipeClientProcessId,
-    },
-};
-
-#[cfg(unix)]
-use tokio::net::UnixStream;
 
 use crate::errors::*;
 
@@ -26,25 +13,7 @@ pub struct Client {
 }
 
 
-#[cfg(unix)]
-pub fn get_client_parent(stream: &UnixStream) -> Result<Client, ClientInfoError> {
-    let pid = stream.peer_cred()?;
-    get_process_parent_info(pid)?
-}
-
-
-#[cfg(windows)]
-pub fn get_client_parent(stream: &NamedPipeServer) -> Result<Client, ClientInfoError> {
-    let raw_handle = stream.as_raw_handle();
-    let mut pid = 0u32;
-    let handle = HANDLE(raw_handle as _);
-    unsafe { GetNamedPipeClientProcessId(handle, &mut pid as *mut u32)? };
-
-    get_process_parent_info(pid)
-}
-
-
-fn get_process_parent_info(pid: u32) -> Result<Client, ClientInfoError> {
+pub fn get_process_parent_info(pid: u32) -> Result<Client, ClientInfoError> {
     let sys_pid = Pid::from_u32(pid);
     let mut sys = System::new();   
     sys.refresh_process(sys_pid);
@@ -64,59 +33,3 @@ fn get_process_parent_info(pid: u32) -> Result<Client, ClientInfoError> {
 
     Ok(Client { pid: parent_pid_sys.as_u32(), exe })
 }
-
-
-// async fn get_associated_pids(local_port: u16) -> Result<Vec<u32>, netstat2::error::Error> {
-//     let state = APP.get().unwrap().state::<AppState>();
-//     let AppConfig {
-//         listen_addr: app_listen_addr,
-//         listen_port: app_listen_port,
-//         ..
-//     } = *state.config.read().await;
-
-//     let sockets_iter = netstat2::iterate_sockets_info(
-//         AddressFamilyFlags::IPV4,
-//         ProtocolFlags::TCP
-//     )?;
-//     for item in sockets_iter {
-//         let sock_info = item?;
-//         let proto_info = match sock_info.protocol_socket_info {
-//             ProtocolSocketInfo::Tcp(tcp_info) => tcp_info,
-//             ProtocolSocketInfo::Udp(_) => {continue;}
-//         };
-
-//         if proto_info.local_port == local_port
-//             && proto_info.remote_port == app_listen_port
-//             && proto_info.local_addr == app_listen_addr
-//             && proto_info.remote_addr == app_listen_addr
-//         {
-//             return Ok(sock_info.associated_pids)
-//         }
-//     }
-//     Ok(vec![])
-// }
-
-
-// Theoretically, on some systems, multiple processes can share a socket
-// pub async fn get_clients(local_port: u16) -> Result<Vec<Option<Client>>, ClientInfoError> {
-//     let mut clients = Vec::new();    
-//     let mut sys = System::new();
-//     for p in get_associated_pids(local_port).await? {
-//         let pid = Pid::from_u32(p);
-//         sys.refresh_process(pid);
-//         let proc = sys.process(pid)
-//             .ok_or(ClientInfoError::ProcessNotFound)?;
-
-//         let client = Client {
-//             pid: p,
-//             exe: proc.exe().to_path_buf(),
-//         };
-//         clients.push(Some(client));
-//     }
-
-//     if clients.is_empty() {
-//         clients.push(None); 
-//     }
-
-//     Ok(clients)
-// }

src-tauri/src/config.rs

@@ -1,16 +1,13 @@
 use std::path::PathBuf;
+use std::time::Duration;
 
 use auto_launch::AutoLaunchBuilder;
 use is_terminal::IsTerminal;
 use serde::{Serialize, Deserialize};
 use sqlx::SqlitePool;
-use tauri::{
-    Manager,
-    GlobalShortcutManager,
-    async_runtime as rt,
-};
 
 use crate::errors::*;
+use crate::kv;
 
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
@@ -38,11 +35,22 @@ pub struct HotkeysConfig {
     pub launch_terminal: Hotkey,
 }
 
+impl HotkeysConfig {
+    pub fn disable_all(&mut self) {
+        self.show_window.enabled = false;
+        self.launch_terminal.enabled = false;
+    }
+}
+
 
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct AppConfig {
     #[serde(default = "default_rehide_ms")]
     pub rehide_ms: u64,
+    #[serde(default = "default_auto_lock")]
+    pub auto_lock: bool,
+    #[serde(default = "default_lock_after")]
+    pub lock_after: Duration,
     #[serde(default = "default_start_minimized")]
     pub start_minimized: bool,
     #[serde(default = "default_start_on_login")]
@@ -58,6 +66,8 @@ impl Default for AppConfig {
     fn default() -> Self {
         AppConfig {
             rehide_ms: default_rehide_ms(),
+            auto_lock: default_auto_lock(),
+            lock_after: default_lock_after(),
             start_minimized: default_start_minimized(),
             start_on_login: default_start_on_login(),
             terminal: default_term_config(),
@@ -68,31 +78,16 @@ impl Default for AppConfig {
 
 
 impl AppConfig {
-    pub async fn load(pool: &SqlitePool) -> Result<AppConfig, SetupError> {
-        let res = sqlx::query!("SELECT * from config where name = 'main'")
-            .fetch_optional(pool)
-            .await?;
+    pub async fn load(pool: &SqlitePool) -> Result<AppConfig, LoadKvError> {
+        let config = kv::load(pool, "config")
+            .await?
+            .unwrap_or_else(|| AppConfig::default());
 
-        let row = match res {
-            Some(row) => row,
-            None => return Ok(AppConfig::default()),
-        };
-
-        Ok(serde_json::from_str(&row.data)?)
+        Ok(config)
     }
 
     pub async fn save(&self, pool: &SqlitePool) -> Result<(), sqlx::error::Error> {
-        let data = serde_json::to_string(self).unwrap();
-        sqlx::query(
-            "INSERT INTO config (name, data) VALUES ('main', ?)
-            ON CONFLICT (name) DO UPDATE SET data = ?"
-        )
-            .bind(&data)
-            .bind(&data)
-            .execute(pool)
-            .await?;
-
-        Ok(())
+        kv::save(pool, "config", self).await
     }
 }
 
@@ -183,45 +178,32 @@ fn default_hotkey_config() -> HotkeysConfig {
     }
 }
 
-// note: will panic if called before APP is set
-pub fn register_hotkeys(hotkeys: &HotkeysConfig) -> tauri::Result<()> {
-    let app = crate::app::APP.get().unwrap();
-
-    let mut manager = app.global_shortcut_manager();
-    manager.unregister_all()?;
-
-    if hotkeys.show_window.enabled {
-        let handle = app.app_handle();
-        manager.register(
-            &hotkeys.show_window.keys,
-            move || { 
-                handle.get_window("main")
-                    .map(|w| w.show().error_popup("Failed to show"))
-                    .ok_or(HandlerError::NoMainWindow)
-                    .error_popup("No main window");
-            },
-        )?;
-    }
-
-    if hotkeys.launch_terminal.enabled {
-        // register() doesn't take an async fn, so we have to use spawn
-        manager.register(
-            &hotkeys.launch_terminal.keys,
-            || { 
-                rt::spawn(async {
-                    crate::terminal::launch(false)
-                        .await
-                        .error_popup("Failed to launch");
-                });
-            }
-        )?;
-    }
-
-    Ok(())
-}
-
 
 fn default_rehide_ms() -> u64 { 1000 }
+fn default_auto_lock() -> bool { true }
+fn default_lock_after() -> Duration { Duration::from_secs(43200) }
 // start minimized and on login only in production mode
 fn default_start_minimized() -> bool { !cfg!(debug_assertions) }
 fn default_start_on_login() -> bool { !cfg!(debug_assertions) }
+
+
+// struct DurationVisitor;
+
+// impl<'de> Visitor<'de> for DurationVisitor {
+//     type Value = Duration;
+
+//     fn expecting(&self, formatter: &mut Formatter) -> fmt::Result {
+//         write!(formatter, "an integer between 0 and 2^64 - 1")
+//     }
+
+//     fn visit_u64<E: de::Error>(self, v: u64) -> Result<Duration, E> {
+//         Ok(Duration::from_secs(v))
+//     }
+// }
+
+
+// fn duration_from_secs<'de, D>(deserializer: D) -> Result<Duration, D::Error>
+// where D: Deserializer<'de>
+// {
+//     deserializer.deserialize_u64(DurationVisitor)
+// }

src-tauri/src/credentials/aws.rs

@@ -0,0 +1,258 @@
+use std::fmt::{self, Formatter};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use aws_config::BehaviorVersion;
+use aws_smithy_types::date_time::{DateTime, Format};
+use chacha20poly1305::XNonce;
+use serde::{
+    Serialize,
+    Deserialize,
+    Serializer,
+    Deserializer,
+};
+use serde::de::{self, Visitor};
+use sqlx::{
+    FromRow,
+    Sqlite,
+    Transaction,
+    types::Uuid,
+};
+
+use super::{Credential, Crypto, PersistentCredential};
+
+use crate::errors::*;
+
+
+#[derive(Debug, Clone, FromRow)]
+pub struct AwsRow {
+    id: Uuid,
+    access_key_id: String,
+    secret_key_enc: Vec<u8>,
+    nonce: Vec<u8>,
+}
+
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "PascalCase")]
+pub struct AwsBaseCredential {
+    #[serde(default = "default_credentials_version")]
+    pub version: usize,
+    pub access_key_id: String,
+    pub secret_access_key: String,
+}
+
+
+impl AwsBaseCredential {
+    pub fn new(access_key_id: String, secret_access_key: String) -> Self {
+        Self {version: 1, access_key_id, secret_access_key}
+    }
+}
+
+impl PersistentCredential for AwsBaseCredential {
+    type Row = AwsRow;
+
+    fn type_name() -> &'static str { "aws" }
+
+    fn into_credential(self) -> Credential { Credential::AwsBase(self) }
+
+    fn row_id(row: &AwsRow) -> Uuid { row.id }
+
+    fn from_row(row: AwsRow, crypto: &Crypto) -> Result<Self, LoadCredentialsError> {
+        let nonce = XNonce::clone_from_slice(&row.nonce);
+        let secret_key_bytes = crypto.decrypt(&nonce, &row.secret_key_enc)?;
+        let secret_key = String::from_utf8(secret_key_bytes)
+            .map_err(|_| LoadCredentialsError::InvalidData)?;
+
+        Ok(Self::new(row.access_key_id, secret_key))
+    }
+
+    async fn save_details(&self, id: &Uuid, crypto: &Crypto, txn: &mut Transaction<'_, Sqlite>) -> Result<(), SaveCredentialsError> {
+        let (nonce, ciphertext) = crypto.encrypt(self.secret_access_key.as_bytes())?;
+        let nonce_bytes = &nonce.as_slice();
+
+        sqlx::query!(
+            "INSERT OR REPLACE INTO aws_credentials (
+                id,
+                access_key_id,
+                secret_key_enc,
+                nonce
+            ) 
+            VALUES (?, ?, ?, ?);",
+            id, self.access_key_id, ciphertext, nonce_bytes,
+        ).execute(&mut **txn).await?;
+
+        Ok(())
+    }
+}
+
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "PascalCase")]
+pub struct AwsSessionCredential {
+    #[serde(default = "default_credentials_version")]
+    pub version: usize,
+    pub access_key_id: String,
+    pub secret_access_key: String,
+    pub session_token: String,
+    #[serde(serialize_with = "serialize_expiration")]
+    #[serde(deserialize_with = "deserialize_expiration")]
+    pub expiration: DateTime,
+}
+
+impl AwsSessionCredential {
+    pub async fn from_base(base: &AwsBaseCredential) -> Result<Self, GetSessionError> {
+        let req_creds = aws_sdk_sts::config::Credentials::new(
+            &base.access_key_id,
+            &base.secret_access_key,
+            None, // token
+            None, //expiration
+            "Creddy", // "provider name" apparently
+        );
+        let config = aws_config::defaults(BehaviorVersion::latest())
+            .credentials_provider(req_creds)
+            .load()
+            .await;
+
+        let client = aws_sdk_sts::Client::new(&config);
+        let resp = client.get_session_token()
+            .duration_seconds(43_200)
+            .send()
+            .await?;
+
+        let aws_session = resp.credentials.ok_or(GetSessionError::EmptyResponse)?;
+
+        let session_creds = AwsSessionCredential {
+            version: 1,
+            access_key_id: aws_session.access_key_id,
+            secret_access_key: aws_session.secret_access_key,
+            session_token: aws_session.session_token,
+            expiration: aws_session.expiration,
+        };
+
+        #[cfg(debug_assertions)]
+        println!("Got new session:\n{}", serde_json::to_string(&session_creds).unwrap());
+
+        Ok(session_creds)
+    }
+
+    pub fn is_expired(&self) -> bool {
+        let current_ts = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap() // doesn't panic because UNIX_EPOCH won't be later than now()
+            .as_secs();
+
+        let expire_ts = self.expiration.secs();
+        let remaining = expire_ts - (current_ts as i64);
+        remaining < 60
+    }
+}
+
+
+fn default_credentials_version() -> usize { 1 }
+
+
+struct DateTimeVisitor;
+
+impl<'de> Visitor<'de> for DateTimeVisitor {
+    type Value = DateTime;
+
+    fn expecting(&self, formatter: &mut Formatter) -> fmt::Result {
+        write!(formatter, "an RFC 3339 UTC string, e.g. \"2014-01-05T10:17:34Z\"")
+    }
+
+    fn visit_str<E: de::Error>(self, v: &str) -> Result<DateTime, E> {
+        DateTime::from_str(v, Format::DateTime)
+            .map_err(|_| E::custom(format!("Invalid date/time: {v}")))
+    }
+}
+
+
+fn deserialize_expiration<'de, D>(deserializer: D) -> Result<DateTime, D::Error>
+where D: Deserializer<'de>
+{
+    deserializer.deserialize_str(DateTimeVisitor)
+}
+
+fn serialize_expiration<S>(exp: &DateTime, serializer: S) -> Result<S::Ok, S::Error>
+where S: Serializer
+{
+    // this only fails if the d/t is out of range, which it can't be for this format
+    let time_str = exp.fmt(Format::DateTime).unwrap();
+    serializer.serialize_str(&time_str)
+}
+
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use sqlx::SqlitePool;
+    use sqlx::types::uuid::uuid;
+
+
+    fn creds() -> AwsBaseCredential {
+        AwsBaseCredential::new(
+            "AKIAIOSFODNN7EXAMPLE".into(),
+            "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY".into(),
+        )
+    }
+
+    fn creds_2() -> AwsBaseCredential {
+        AwsBaseCredential::new(
+            "AKIAIOSFODNN7EXAMPL2".into(),
+            "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKE2".into(),
+        )
+    }
+
+    fn test_uuid() -> Uuid {
+        Uuid::try_parse("00000000-0000-0000-0000-000000000000").unwrap()
+    }
+
+    fn test_uuid_2() -> Uuid {
+        Uuid::try_parse("ffffffff-ffff-ffff-ffff-ffffffffffff").unwrap()
+    }
+
+    fn test_uuid_random() -> Uuid {
+        let bytes = Crypto::salt();
+        Uuid::from_slice(&bytes[..16]).unwrap()
+    }
+
+
+    #[sqlx::test(fixtures("aws_credentials"))]
+    async fn test_load(pool: SqlitePool) {
+        let crypt = Crypto::fixed();
+        let id = uuid!("00000000-0000-0000-0000-000000000000");
+        let loaded = AwsBaseCredential::load(&id, &crypt, &pool).await.unwrap();
+        assert_eq!(creds(), loaded);
+    }
+
+
+    #[sqlx::test(fixtures("aws_credentials"))]
+    async fn test_load_by_name(pool: SqlitePool) {
+        let crypt = Crypto::fixed();
+        let loaded = AwsBaseCredential::load_by_name("test2", &crypt, &pool).await.unwrap();
+        assert_eq!(creds_2(), loaded);
+    }
+
+
+    #[sqlx::test(fixtures("aws_credentials"))]
+    async fn test_load_default(pool: SqlitePool) {
+        let crypt = Crypto::fixed();
+        let loaded = AwsBaseCredential::load_default(&crypt, &pool).await.unwrap();
+        assert_eq!(creds(), loaded)
+    }
+
+
+    #[sqlx::test(fixtures("aws_credentials"))]
+    async fn test_list(pool: SqlitePool) {
+        let crypt = Crypto::fixed();
+        let list: Vec<_> = AwsBaseCredential::list(&crypt, &pool)
+            .await
+            .expect("Failed to load credentials")
+            .into_iter()
+            .map(|(_, cred)| cred)
+            .collect();
+
+        assert_eq!(&creds().into_credential(), &list[0]);
+        assert_eq!(&creds_2().into_credential(), &list[1]);
+    }   
+}

src-tauri/src/credentials/crypto.rs

@@ -0,0 +1,116 @@
+use std::fmt::{Debug, Formatter};
+use argon2::{
+    Argon2,
+    Algorithm,
+    Version,
+    ParamsBuilder,
+    password_hash::rand_core::{RngCore, OsRng},
+};
+use chacha20poly1305::{
+    XChaCha20Poly1305,
+    XNonce,
+    aead::{
+        Aead,
+        AeadCore,
+        KeyInit,
+        generic_array::GenericArray,
+    },
+};
+
+use crate::errors::*;
+
+
+#[derive(Clone)]
+pub struct Crypto {
+    cipher: XChaCha20Poly1305,
+}
+
+impl Crypto {
+    /// Argon2 params rationale:
+    ///
+    /// m_cost is measured in KiB, so 128 * 1024 gives us 128MiB.
+    /// This should roughly double the memory usage of the application
+    /// while deriving the key.
+    ///
+    /// p_cost is irrelevant since (at present) there isn't any parallelism
+    /// implemented, so we leave it at 1.
+    ///
+    /// With the above m_cost, t_cost = 8 results in about 800ms to derive
+    /// a key on my (somewhat older) CPU. This is probably overkill, but
+    /// given that it should only have to happen ~once a day for most 
+    /// usage, it should be acceptable.
+    #[cfg(not(debug_assertions))]
+    const MEM_COST: u32 = 128 * 1024;
+    #[cfg(not(debug_assertions))]
+    const TIME_COST: u32 = 8;
+
+    /// But since this takes a million years without optimizations,
+    /// we turn it way down in debug builds.
+    #[cfg(debug_assertions)]
+    const MEM_COST: u32 = 48 * 1024;
+    #[cfg(debug_assertions)]
+    const TIME_COST: u32 = 1;
+    
+
+    pub fn new(passphrase: &str, salt: &[u8]) -> argon2::Result<Crypto> {
+        let params = ParamsBuilder::new()
+            .m_cost(Self::MEM_COST)
+            .p_cost(1)
+            .t_cost(Self::TIME_COST)
+            .build()
+            .unwrap(); // only errors if the given params are invalid
+
+        let hasher = Argon2::new(
+            Algorithm::Argon2id,
+            Version::V0x13,
+            params,
+        );
+
+        let mut key = [0; 32];
+        hasher.hash_password_into(passphrase.as_bytes(), &salt, &mut key)?;
+        let cipher = XChaCha20Poly1305::new(GenericArray::from_slice(&key));
+        Ok(Crypto { cipher })
+    }
+
+    #[cfg(test)]
+    pub fn random() -> Crypto {
+        // salt and key are the same length, so we can just use this
+        let key = Crypto::salt();
+        let cipher = XChaCha20Poly1305::new(GenericArray::from_slice(&key));
+        Crypto { cipher }
+    }
+
+    #[cfg(test)]
+    pub fn fixed() -> Crypto {
+        let key = [
+            1u8, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16,
+            17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32,
+        ];
+
+        let cipher = XChaCha20Poly1305::new(GenericArray::from_slice(&key));
+        Crypto { cipher }
+    }
+
+    pub fn salt() -> [u8; 32] {
+        let mut salt = [0; 32];
+        OsRng.fill_bytes(&mut salt);
+        salt
+    }
+
+    pub fn encrypt(&self, data: &[u8]) -> Result<(XNonce, Vec<u8>), CryptoError> {
+        let nonce = XChaCha20Poly1305::generate_nonce(&mut OsRng);
+        let ciphertext = self.cipher.encrypt(&nonce, data)?;
+        Ok((nonce, ciphertext))
+    }
+
+    pub fn decrypt(&self, nonce: &XNonce, data: &[u8]) -> Result<Vec<u8>, CryptoError> {
+        let plaintext = self.cipher.decrypt(nonce, data)?;
+        Ok(plaintext)
+    }
+}
+
+impl Debug for Crypto {
+    fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), std::fmt::Error> {
+        write!(f, "Crypto {{ [...] }}")
+    }
+}

src-tauri/src/credentials/fixtures/aws_credentials.sql

@@ -0,0 +1,19 @@
+INSERT INTO credentials (id, name, credential_type, is_default, created_at)
+VALUES
+    (X'00000000000000000000000000000000', 'test', 'aws', 1, strftime('%s')),
+    (X'ffffffffffffffffffffffffffffffff', 'test2', 'aws', 0, strftime('%s'));
+
+INSERT INTO aws_credentials (id, access_key_id, secret_key_enc, nonce)
+VALUES 
+    (
+        X'00000000000000000000000000000000',
+        'AKIAIOSFODNN7EXAMPLE',
+        X'B09ACDADD07E295A3FD9146D8D3672FA5C2518BFB15CF039E68820C42EFD3BC3BE3156ACF438C2C957EC113EF8617DBC71790EAFE39B3DE8',
+        X'DB777F2C6315DC0E12ADF322256E69D09D7FB586AAE614A6'
+    ),
+    (
+        X'ffffffffffffffffffffffffffffffff',
+        'AKIAIOSFODNN7EXAMPL2',
+        X'ED6125FF40EF6F61929DF5FFD7141CD2B5A302A51C20152156477F8CC77980C614AB1B212AC06983F3CED35C4F3C54D4EE38964859930FBF',
+        X'962396B78DAA98DFDCC0AC0C9B7D688EC121F5759EBA790A'
+    );

src-tauri/src/credentials/mod.rs

@@ -0,0 +1,116 @@
+use serde::{Serialize, Deserialize};
+use sqlx::{
+    FromRow,
+    Sqlite,
+    SqlitePool,
+    sqlite::SqliteRow,
+    Transaction,
+    types::Uuid,
+};
+use tokio_stream::StreamExt;
+
+use crate::errors::*;
+
+mod aws;
+pub use aws::{AwsBaseCredential, AwsSessionCredential};
+
+mod record;
+pub use record::CredentialRecord;
+
+mod session;
+pub use session::AppSession;
+
+mod crypto;
+pub use crypto::Crypto;
+
+
+#[derive(Debug, Clone, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(tag = "type")]
+pub enum Credential {
+    AwsBase(AwsBaseCredential),
+    AwsSession(AwsSessionCredential),
+}
+
+
+pub trait PersistentCredential: for<'a> Deserialize<'a> + Sized {
+    type Row: Send + Unpin + for<'r> FromRow<'r, SqliteRow>;
+
+    fn type_name() -> &'static str;
+
+    fn into_credential(self) -> Credential;
+
+    fn row_id(row: &Self::Row) -> Uuid;
+
+    fn from_row(row: Self::Row, crypto: &Crypto) -> Result<Self, LoadCredentialsError>;
+
+    // save_details needs to be implemented per-type because we don't know the number of parameters in advance
+    async fn save_details(&self, id: &Uuid, crypto: &Crypto, txn: &mut Transaction<'_, Sqlite>) -> Result<(), SaveCredentialsError>;
+
+    fn table_name() -> String {
+        format!("{}_credentials", Self::type_name())
+    }
+
+    async fn load(id: &Uuid, crypto: &Crypto, pool: &SqlitePool) -> Result<Self, LoadCredentialsError> {
+        let q = format!("SELECT * FROM {} WHERE id = ?", Self::table_name());
+        let row: Self::Row = sqlx::query_as(&q)
+            .bind(id)
+            .fetch_optional(pool)
+            .await?
+            .ok_or(LoadCredentialsError::NoCredentials)?;
+
+        Self::from_row(row, crypto)
+    }
+
+    async fn load_by_name(name: &str, crypto: &Crypto, pool: &SqlitePool) -> Result<Self, LoadCredentialsError> {
+        let q = format!(
+            "SELECT * FROM {} WHERE id = (SELECT id FROM credentials WHERE name = ?)",
+            Self::table_name(),
+        );
+        let row: Self::Row = sqlx::query_as(&q)
+            .bind(name)
+            .fetch_optional(pool)
+            .await?
+            .ok_or(LoadCredentialsError::NoCredentials)?;
+
+        Self::from_row(row, crypto)
+    }
+
+    async fn load_default(crypto: &Crypto, pool: &SqlitePool) -> Result<Self, LoadCredentialsError> {
+        let q = format!(
+            "SELECT details.*
+            FROM {} details
+                JOIN credentials c
+                    ON c.id = details.id
+                    AND c.is_default = 1",
+            Self::table_name(),
+        );
+        let row: Self::Row = sqlx::query_as(&q)
+            .fetch_optional(pool)
+            .await?
+            .ok_or(LoadCredentialsError::NoCredentials)?;
+
+        Self::from_row(row, crypto)
+    }
+
+    async fn list(crypto: &Crypto, pool: &SqlitePool) -> Result<Vec<(Uuid, Credential)>, LoadCredentialsError> {
+        let q = format!(
+            "SELECT details.*
+            FROM 
+                {} details
+                JOIN credentials c
+                    ON c.id = details.id
+             ORDER BY c.created_at", 
+             Self::table_name(),
+        );
+        let mut rows = sqlx::query_as::<_, Self::Row>(&q).fetch(pool);
+        
+        let mut creds = Vec::new();
+        while let Some(row) = rows.try_next().await? {
+            let id = Self::row_id(&row);
+            let cred = Self::from_row(row, crypto)?.into_credential();
+            creds.push((id, cred));
+        }
+
+        Ok(creds)
+    }
+}

src-tauri/src/credentials/record.rs

@@ -0,0 +1,410 @@
+use std::collections::HashMap;
+use std::fmt::{self, Debug, Formatter};
+use serde::{
+    Serialize,
+    Deserialize,
+    Serializer,
+    Deserializer,
+};
+use serde::de::{self, Visitor};
+use sqlx::{
+    Error as SqlxError,
+    FromRow,
+    SqlitePool,
+    types::Uuid,
+};
+use tokio_stream::StreamExt;
+
+use crate::errors::*;
+use super::{
+    AwsBaseCredential,
+    Credential,
+    Crypto,
+    PersistentCredential,
+};
+
+
+#[derive(Debug, Clone, FromRow)]
+struct CredentialRow {
+    id: Uuid,
+    name: String,
+    credential_type: String,
+    is_default: bool,
+    created_at: i64,
+}
+
+
+#[derive(Debug, Clone, Eq, PartialEq, Serialize, Deserialize)]
+pub struct CredentialRecord {
+    #[serde(serialize_with = "serialize_uuid")]
+    #[serde(deserialize_with = "deserialize_uuid")]
+    id: Uuid, // UUID so it can be generated on the frontend
+    name: String, // user-facing identifier so it can be changed
+    is_default: bool,
+    credential: Credential,
+}
+
+impl CredentialRecord {
+    pub async fn save(&self, crypto: &Crypto, pool: &SqlitePool) -> Result<(), SaveCredentialsError> {
+        let type_name = match &self.credential {
+            Credential::AwsBase(_) => AwsBaseCredential::type_name(),
+            _ => return Err(SaveCredentialsError::NotPersistent),
+        };
+
+        // if the credential being saved is default, make sure it's the only default of its type
+        let mut txn = pool.begin().await?;
+        if self.is_default {
+            sqlx::query!(
+                "UPDATE credentials SET is_default = 0 WHERE credential_type = ?",
+                type_name
+            ).execute(&mut *txn).await?;
+        }
+
+        // save to parent credentials table
+        let res = sqlx::query!(
+            "INSERT INTO credentials (id, name, credential_type, is_default, created_at)
+            VALUES (?, ?, ?, ?, strftime('%s'))
+            ON CONFLICT(id) DO UPDATE SET
+                name = excluded.name,
+                credential_type = excluded.credential_type,
+                is_default = excluded.is_default",
+            self.id, self.name, type_name, self.is_default
+        ).execute(&mut *txn).await;
+
+        // if id is unique, but name is not, we will get an error
+        // (if id is not unique, this becomes an upsert due to ON CONFLICT clause)
+        match res {
+            Err(SqlxError::Database(e)) if e.is_unique_violation() => Err(SaveCredentialsError::Duplicate),
+            Err(e) => Err(SaveCredentialsError::DbError(e)),
+            Ok(_) => Ok(())
+        }?;
+
+        // save credential details to child table
+        match &self.credential {
+            Credential::AwsBase(b) => b.save_details(&self.id, crypto, &mut txn).await,
+            _ => Err(SaveCredentialsError::NotPersistent),
+        }?;
+
+        // make it real
+        txn.commit().await?;
+        Ok(())
+    }
+
+    fn from_parts(row: CredentialRow, credential: Credential) -> Self {
+        CredentialRecord {
+            id: row.id,
+            name: row.name,
+            is_default: row.is_default,
+            credential,
+        }
+    }
+
+    async fn load_credential(row: CredentialRow, crypto: &Crypto, pool: &SqlitePool) -> Result<Self, LoadCredentialsError> {
+        let credential = match row.credential_type.as_str() {
+            "aws" => Credential::AwsBase(AwsBaseCredential::load(&row.id, crypto, pool).await?),
+            _ => return Err(LoadCredentialsError::InvalidData),
+        };
+
+        Ok(Self::from_parts(row, credential))
+    }
+
+    pub async fn load(id: &Uuid, crypto: &Crypto, pool: &SqlitePool) -> Result<Self, LoadCredentialsError> {
+        let row: CredentialRow = sqlx::query_as("SELECT * FROM credentials WHERE id = ?")
+            .bind(id)
+            .fetch_optional(pool)
+            .await?
+            .ok_or(LoadCredentialsError::NoCredentials)?;
+
+        Self::load_credential(row, crypto, pool).await
+    }
+
+    pub async fn load_default(credential_type: &str, crypto: &Crypto, pool: &SqlitePool) -> Result<Self, LoadCredentialsError> {
+        let row: CredentialRow = sqlx::query_as(
+            "SELECT * FROM credentials 
+            WHERE credential_type = ? AND is_default = 1"
+        ).bind(credential_type)
+            .fetch_optional(pool)
+            .await?
+            .ok_or(LoadCredentialsError::NoCredentials)?;
+
+        Self::load_credential(row, crypto, pool).await
+    }
+
+    pub async fn list(crypto: &Crypto, pool: &SqlitePool) -> Result<Vec<Self>, LoadCredentialsError> {
+        let mut parent_rows = sqlx::query_as::<_, CredentialRow>(
+            "SELECT * FROM credentials"
+        ).fetch(pool);
+
+        let mut parent_map = HashMap::new();
+        while let Some(row) = parent_rows.try_next().await? {
+            parent_map.insert(row.id, row);
+        }
+
+        let mut records = Vec::with_capacity(parent_map.len());
+
+        for (id, credential) in AwsBaseCredential::list(crypto, pool).await? {
+            let parent = parent_map.remove(&id)
+                .ok_or(LoadCredentialsError::InvalidData)?;
+            records.push(Self::from_parts(parent, credential));
+        }
+
+        Ok(records)
+    }
+
+    pub async fn rekey(old: &Crypto, new: &Crypto, pool: &SqlitePool) -> Result<(), SaveCredentialsError> {
+        for record in Self::list(old, pool).await? {
+            record.save(new, pool).await?;
+        }
+        Ok(())
+    }
+}
+
+
+fn serialize_uuid<S: Serializer>(u: &Uuid, s: S) -> Result<S::Ok, S::Error> {
+    let mut buf = Uuid::encode_buffer();
+    s.serialize_str(u.as_hyphenated().encode_lower(&mut buf))
+}
+
+struct UuidVisitor;
+
+impl<'de> Visitor<'de> for UuidVisitor {
+    type Value = Uuid;
+
+    fn expecting(&self, formatter: &mut Formatter) -> fmt::Result {
+        write!(formatter, "a hyphenated UUID")
+    }
+
+    fn visit_str<E: de::Error>(self, v: &str) -> Result<Uuid, E> {
+        Uuid::try_parse(v)
+            .map_err(|_| E::custom(format!("Could not interpret string as UUID: {v}")))
+    }
+}
+
+fn deserialize_uuid<'de, D: Deserializer<'de>>(ds: D) -> Result<Uuid, D::Error> {
+    ds.deserialize_str(UuidVisitor)
+}
+
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use sqlx::types::uuid::uuid;
+
+
+    fn aws_record() -> CredentialRecord {
+        let id = uuid!("00000000-0000-0000-0000-000000000000");
+        let aws = AwsBaseCredential::new(
+            "AKIAIOSFODNN7EXAMPLE".into(),
+            "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY".into(),
+        );
+
+        CredentialRecord {
+            id,
+            name: "test".into(),
+            is_default: true,
+            credential: Credential::AwsBase(aws),
+        }
+    }
+
+    fn aws_record_2() -> CredentialRecord {
+        let id = uuid!("ffffffff-ffff-ffff-ffff-ffffffffffff");
+        let aws = AwsBaseCredential::new(
+            "AKIAIOSFODNN7EXAMPL2".into(),
+            "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKE2".into(),
+        );
+
+        CredentialRecord {
+            id,
+            name: "test2".into(),
+            is_default: false,
+            credential: Credential::AwsBase(aws),
+        }
+    }
+
+    fn random_uuid() -> Uuid {
+        let bytes = Crypto::salt();
+        Uuid::from_slice(&bytes[..16]).unwrap()
+    }
+
+
+    #[sqlx::test(fixtures("aws_credentials"))]
+    async fn test_load_aws(pool: SqlitePool) {
+        let crypt = Crypto::fixed();
+        let id = uuid!("00000000-0000-0000-0000-000000000000");
+        let loaded = CredentialRecord::load(&id, &crypt, &pool).await
+            .expect("Failed to load record");
+
+        assert_eq!(aws_record(), loaded);
+    }
+
+
+    #[sqlx::test(fixtures("aws_credentials"))]
+    async fn test_load_aws_default(pool: SqlitePool) {
+        let crypt = Crypto::fixed();
+        let loaded = CredentialRecord::load_default("aws", &crypt, &pool).await
+            .expect("Failed to load record");
+
+        assert_eq!(aws_record(), loaded);
+    }
+
+
+    #[sqlx::test]
+    async fn test_save_aws(pool: SqlitePool) {
+        let crypt = Crypto::random();
+        let mut record = aws_record();
+        record.id = random_uuid();
+
+        aws_record().save(&crypt, &pool).await
+            .expect("Failed to save record");
+    }
+
+
+    #[sqlx::test]
+    async fn test_save_load(pool: SqlitePool) {
+        let crypt = Crypto::random();
+        let mut record = aws_record();
+        record.id = random_uuid();
+
+        record.save(&crypt, &pool).await
+            .expect("Failed to save record");
+        let loaded = CredentialRecord::load(&record.id, &crypt, &pool).await
+            .expect("Failed to load record");
+
+        assert_eq!(record, loaded);
+    }
+
+
+    #[sqlx::test]
+    async fn test_overwrite_aws(pool: SqlitePool) {
+        let crypt = Crypto::fixed();
+
+        let original = aws_record();
+        original.save(&crypt, &pool).await
+            .expect("Failed to save first record");
+
+        let mut updated = aws_record_2();
+        updated.id = original.id;
+        updated.save(&crypt, &pool).await
+            .expect("Failed to overwrite first record with second record");
+
+        // make sure update went through
+        let loaded = CredentialRecord::load(&updated.id, &crypt, &pool).await.unwrap();
+        assert_eq!(updated, loaded);
+    }
+
+
+    #[sqlx::test(fixtures("aws_credentials"))]
+    async fn test_duplicate_name(pool: SqlitePool) {
+        let crypt = Crypto::random();
+
+        let mut record = aws_record();
+        record.id = random_uuid();
+        let resp = record.save(&crypt, &pool).await;
+
+        if !matches!(resp, Err(SaveCredentialsError::Duplicate)) {
+            panic!("Attempt to create duplicate entry returned {resp:?}")
+        }
+    }
+
+
+    #[sqlx::test(fixtures("aws_credentials"))]
+    async fn test_change_default(pool: SqlitePool) {
+        let crypt = Crypto::fixed();
+        let id = uuid!("ffffffff-ffff-ffff-ffff-ffffffffffff");
+
+        // confirm that record as it currently exists in the database is not default
+        let mut record = CredentialRecord::load(&id, &crypt, &pool).await
+            .expect("Failed to load record");
+        assert!(!record.is_default);
+
+        record.is_default = true;
+        record.save(&crypt, &pool).await
+            .expect("Failed to save record");
+
+        let loaded = CredentialRecord::load(&id, &crypt, &pool).await
+            .expect("Failed to re-load record");
+        assert!(loaded.is_default);
+
+        let other_id = uuid!("00000000-0000-0000-0000-000000000000");
+        let other_loaded = CredentialRecord::load(&other_id, &crypt, &pool).await
+            .expect("Failed to load other credential");
+        assert!(!other_loaded.is_default);
+    }
+
+
+    #[sqlx::test(fixtures("aws_credentials"))]
+    async fn test_list(pool: SqlitePool) {
+        let crypt = Crypto::fixed();
+
+        let records = CredentialRecord::list(&crypt, &pool).await
+            .expect("Failed to list credentials");
+
+        assert_eq!(aws_record(), records[0]);
+        assert_eq!(aws_record_2(), records[1]);
+    }
+
+
+    #[sqlx::test(fixtures("aws_credentials"))]
+    async fn test_rekey(pool: SqlitePool) {
+        let old = Crypto::fixed();
+        let new = Crypto::random();
+
+        CredentialRecord::rekey(&old, &new, &pool).await
+            .expect("Failed to rekey credentials");
+
+        let records = CredentialRecord::list(&new, &pool).await
+            .expect("Failed to re-list credentials");
+
+        assert_eq!(aws_record(), records[0]);
+        assert_eq!(aws_record_2(), records[1]);
+    }
+}
+
+
+#[cfg(test)]
+mod uuid_tests {
+    use super::*;
+    use sqlx::types::uuid::uuid;
+
+
+    #[derive(Debug, Eq, PartialEq, Serialize, Deserialize)]
+    struct UuidWrapper {
+        #[serde(serialize_with = "serialize_uuid")]
+        #[serde(deserialize_with = "deserialize_uuid")]
+        id: Uuid,
+    }
+
+
+    #[test]
+    fn test_serialize_uuid() {
+        let u = UuidWrapper {
+            id: uuid!("693f84d2-4c1b-41e5-8483-cbe178324e04")
+        };
+        let computed = serde_json::to_string(&u).unwrap();
+        assert_eq!(
+            "{\"id\":\"693f84d2-4c1b-41e5-8483-cbe178324e04\"}",
+            &computed,
+        );
+    }
+
+    #[test]
+    fn test_deserialize_uuid() {
+        let s = "{\"id\":\"045bd359-8630-4b76-9b7d-e4a86ed2222c\"}";
+        let computed = serde_json::from_str(s).unwrap();
+        let expected = UuidWrapper {
+            id: uuid!("045bd359-8630-4b76-9b7d-e4a86ed2222c"),
+        };
+        assert_eq!(expected, computed);
+    }
+
+    #[test]
+    fn test_serialize_deserialize_uuid() {
+        let buf = Crypto::salt();
+        let expected = UuidWrapper{ 
+            id: Uuid::from_slice(&buf[..16]).unwrap()
+        };
+        let serialized = serde_json::to_string(&expected).unwrap();
+        let computed = serde_json::from_str(&serialized).unwrap();
+        assert_eq!(expected, computed)
+    }
+}

src-tauri/src/credentials/session.rs

@@ -0,0 +1,120 @@
+use chacha20poly1305::XNonce;
+use sqlx::SqlitePool;
+
+use crate::errors::*;
+use crate::kv;
+use super::Crypto;
+
+
+#[derive(Clone, Debug)]
+pub enum AppSession {
+    Unlocked {
+        salt: [u8; 32],
+        crypto: Crypto,
+    },
+    Locked {
+        salt: [u8; 32],
+        verify_nonce: XNonce,
+        verify_blob: Vec<u8>
+    },
+    Empty,
+}
+
+impl AppSession {
+    pub fn new(passphrase: &str) -> Result<Self, CryptoError> {
+        let salt = Crypto::salt();
+        let crypto = Crypto::new(passphrase, &salt)?;
+        Ok(Self::Unlocked {salt, crypto})
+    }
+
+    pub fn unlock(&mut self, passphrase: &str) -> Result<(), UnlockError> {
+        let (salt, nonce, blob) = match self {
+            Self::Empty => return Err(UnlockError::NoCredentials),
+            Self::Unlocked {..} => return Err(UnlockError::NotLocked),
+            Self::Locked {salt, verify_nonce, verify_blob} => (salt, verify_nonce, verify_blob),
+        };
+
+        let crypto = Crypto::new(passphrase, salt)
+            .map_err(|e| CryptoError::Argon2(e))?;
+
+        // if passphrase is incorrect, this will fail
+        let _verify = crypto.decrypt(&nonce, &blob)?;
+
+        *self = Self::Unlocked {crypto, salt: *salt};
+        Ok(())
+    }
+
+    pub async fn load(pool: &SqlitePool) -> Result<Self, LoadCredentialsError> {
+        match kv::load_bytes_multi!(pool, "salt", "verify_nonce", "verify_blob").await? {
+            Some((salt, nonce, blob)) => {
+
+                Ok(Self::Locked {
+                    salt: salt.try_into().map_err(|_| LoadCredentialsError::InvalidData)?,
+                    // note: replace this with try_from at some point
+                    verify_nonce: XNonce::clone_from_slice(&nonce),
+                    verify_blob: blob,
+                })
+            },
+            None => Ok(Self::Empty),
+        }
+    }
+
+    pub async fn save(&self, pool: &SqlitePool) -> Result<(), SaveCredentialsError> {
+        match self {
+            Self::Unlocked {salt, crypto} => {
+                let (nonce, blob) = crypto.encrypt(b"correct horse battery staple")?;
+                kv::save_bytes(pool, "salt", salt).await?;
+                kv::save_bytes(pool, "verify_nonce", &nonce.as_slice()).await?;
+                kv::save_bytes(pool, "verify_blob", &blob).await?;
+            },
+            Self::Locked {salt, verify_nonce, verify_blob} => {
+                kv::save_bytes(pool, "salt", salt).await?;
+                kv::save_bytes(pool, "verify_nonce", &verify_nonce.as_slice()).await?;
+                kv::save_bytes(pool, "verify_blob", verify_blob).await?;
+            },
+            // "saving" an empty session just means doing nothing
+            Self::Empty => (),
+        };
+
+        Ok(())
+    }
+
+    pub async fn reset(&mut self, pool: &SqlitePool) -> Result<(), SaveCredentialsError> {
+        match self {            
+            Self::Unlocked {..} | Self::Locked {..} => {
+                kv::delete_multi(pool, &["salt", "verify_nonce", "verify_blob"]).await?;
+                *self = Self::Empty;
+            },
+            Self::Empty => (),
+        }
+        Ok(())
+    }
+
+    pub fn try_get_crypto(&self) -> Result<&Crypto, GetCredentialsError> {
+        match self {
+            Self::Empty => Err(GetCredentialsError::Empty),
+            Self::Locked {..} => Err(GetCredentialsError::Locked),
+            Self::Unlocked {crypto, ..} => Ok(crypto),
+        }
+    }
+
+    pub fn try_encrypt(&self, data: &[u8]) -> Result<(XNonce, Vec<u8>), GetCredentialsError> {
+        let crypto = match self {
+            Self::Empty => return Err(GetCredentialsError::Empty),
+            Self::Locked {..} => return Err(GetCredentialsError::Locked),
+            Self::Unlocked {crypto, ..} => crypto,
+        };
+        let res = crypto.encrypt(data)?;
+        Ok(res)
+    }
+
+    pub fn try_decrypt(&self, nonce: XNonce, data: &[u8]) -> Result<Vec<u8>, GetCredentialsError> {
+        let crypto = match self {
+            Self::Empty => return Err(GetCredentialsError::Empty),
+            Self::Locked {..} => return Err(GetCredentialsError::Locked),
+            Self::Unlocked {crypto, ..} => crypto,
+        };
+        let res = crypto.decrypt(&nonce, data)?;
+        Ok(res)
+    }
+}

src-tauri/src/errors.rs

@@ -1,23 +1,26 @@
 use std::error::Error;
 use std::convert::AsRef;
 use std::ffi::OsString;
-use std::sync::mpsc;
 use std::string::FromUtf8Error;
 use strum_macros::AsRefStr;
 
 use thiserror::Error as ThisError;
 use aws_sdk_sts::{
-    types::SdkError as AwsSdkError, 
-    error::GetSessionTokenError,
+    error::SdkError as AwsSdkError,
+    operation::get_session_token::GetSessionTokenError,
+    error::ProvideErrorMetadata,
+};
+use rfd::{
+    AsyncMessageDialog,
+    MessageLevel,
 };
 use sqlx::{
     error::Error as SqlxError,
     migrate::MigrateError,
 };
-use tauri::api::dialog::{
-    MessageDialogBuilder, 
-    MessageDialogKind,
-};
+use tauri::async_runtime as rt;
+use tauri_plugin_global_shortcut::Error as ShortcutError;
+use tokio::sync::oneshot::error::RecvError;
 use serde::{
     Serialize,
     Serializer,
@@ -26,28 +29,35 @@ use serde::{
 };
 
 
-pub trait ErrorPopup {
+pub trait ShowError<T, E>
+{
     fn error_popup(self, title: &str);
-    fn error_popup_nowait(self, title: &str);
+    fn error_print(self);
+    fn error_print_prefix(self, prefix: &str);
 }
 
-impl<E: std::fmt::Display> ErrorPopup for Result<(), E> {
+impl<T, E> ShowError<T, E> for Result<T, E> 
+where E: std::fmt::Display
+{
     fn error_popup(self, title: &str) {
         if let Err(e) = self {
-            let (tx, rx) = mpsc::channel();
-            MessageDialogBuilder::new(title, format!("{e}"))
-                .kind(MessageDialogKind::Error)
-                .show(move |_| tx.send(true).unwrap());
-
-            rx.recv().unwrap();
+            let dialog = AsyncMessageDialog::new()
+                .set_level(MessageLevel::Error)
+                .set_title(title)
+                .set_description(format!("{e}"));
+            rt::spawn(async move {dialog.show().await});
         }
     }
 
-    fn error_popup_nowait(self, title: &str) {
+    fn error_print(self) {
         if let Err(e) = self {
-            MessageDialogBuilder::new(title, format!("{e}"))
-                .kind(MessageDialogKind::Error)
-                .show(|_| {})
+            eprintln!("{e}");
+        }
+    }
+
+    fn error_print_prefix(self, prefix: &str) {
+        if let Err(e) = self {
+            eprintln!("{prefix}: {e}");
         }
     }
 }
@@ -68,15 +78,33 @@ where
 }
 
 
+struct SerializeUpstream<E>(pub E);
+
+impl<E: Error> Serialize for SerializeUpstream<E> {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let msg = format!("{}", self.0);
+        let mut map = serializer.serialize_map(None)?;
+        map.serialize_entry("msg", &msg)?;
+        map.serialize_entry("code", &None::<&str>)?;
+        map.serialize_entry("source", &None::<&str>)?;
+        map.end()
+    }
+}
+
 fn serialize_upstream_err<E, M>(err: &E, map: &mut M) -> Result<(), M::Error> 
 where
     E: Error,
     M: serde::ser::SerializeMap,
 {
-    let msg = err.source().map(|s| format!("{s}"));
-    map.serialize_entry("msg", &msg)?;
-    map.serialize_entry("code", &None::<&str>)?;
-    map.serialize_entry("source", &None::<&str>)?;
+    // let msg = err.source().map(|s| format!("{s}"));
+    // map.serialize_entry("msg", &msg)?;
+    // map.serialize_entry("code", &None::<&str>)?;
+    // map.serialize_entry("source", &None::<&str>)?;
+
+    match err.source() {
+        Some(src) => map.serialize_entry("source", &SerializeUpstream(src))?,
+        None => map.serialize_entry("source", &None::<&str>)?,
+    }
 
     Ok(())
 }
@@ -100,10 +128,10 @@ pub enum SetupError {
     InvalidRecord, // e.g. wrong size blob for nonce or salt
     #[error("Error from database: {0}")]
     DbError(#[from] SqlxError),
+    #[error("Error loading data: {0}")]
+    KvError(#[from] LoadKvError),
     #[error("Error running migrations: {0}")]
     MigrationError(#[from] MigrateError),
-    #[error("Error parsing configuration from database")]
-    ConfigParseError(#[from] serde_json::Error),
     #[error("Failed to set up start-on-login: {0}")]
     AutoLaunchError(#[from] auto_launch::Error),
     #[error("Failed to start listener: {0}")]
@@ -111,7 +139,7 @@ pub enum SetupError {
     #[error("Failed to resolve data directory: {0}")]
     DataDir(#[from] DataDirError),
     #[error("Failed to register hotkeys: {0}")]
-    RegisterHotkeys(#[from] tauri::Error),
+    RegisterHotkeys(#[from] ShortcutError),
 }
 
 
@@ -138,7 +166,7 @@ pub enum SendResponseError {
 }
 
 
-// errors encountered while handling an HTTP request
+// errors encountered while handling a client request
 #[derive(Debug, ThisError, AsRefStr)]
 pub enum HandlerError {
     #[error("Error writing to stream: {0}")]
@@ -149,8 +177,10 @@ pub enum HandlerError {
     BadRequest(#[from] serde_json::Error),
     #[error("HTTP request too large")]
     RequestTooLarge,
+    #[error("Connection closed early by client")]
+    Abandoned,
     #[error("Internal server error")]
-    Internal,
+    Internal(#[from] RecvError),
     #[error("Error accessing credentials: {0}")]
     NoCredentials(#[from] GetCredentialsError),
     #[error("Error getting client details: {0}")]
@@ -164,12 +194,27 @@ pub enum HandlerError {
 }
 
 
+#[derive(Debug, ThisError, AsRefStr)]
+pub enum WindowError {
+    #[error("Failed to find main application window")]
+    NoMainWindow,
+    #[error(transparent)]
+    ManageFailure(#[from] tauri::Error),
+}
+
+
 #[derive(Debug, ThisError, AsRefStr)]
 pub enum GetCredentialsError {
     #[error("Credentials are currently locked")]
     Locked,
     #[error("No credentials are known")]
     Empty,
+    #[error(transparent)]
+    Crypto(#[from] CryptoError),
+    #[error(transparent)]
+    Load(#[from] LoadCredentialsError),
+    #[error(transparent)]
+    GetSession(#[from] GetSessionError),
 }
 
 
@@ -179,7 +224,7 @@ pub enum GetSessionError {
     EmptyResponse, // SDK returned successfully but credentials are None
     #[error("Error response from AWS SDK: {0}")]
     SdkError(#[from] AwsSdkError<GetSessionTokenError>),
-    #[error("Could not construt session: credentials are locked")]
+    #[error("Could not construct session: credentials are locked")]
     CredentialsLocked,
     #[error("Could not construct session: no credentials are known")]
     CredentialsEmpty,
@@ -203,12 +248,75 @@ pub enum UnlockError {
 }
 
 
+#[derive(Debug, ThisError, AsRefStr)]
+pub enum LockError {
+    #[error("App is not unlocked")]
+    NotUnlocked,
+    #[error(transparent)]
+    LoadCredentials(#[from] LoadCredentialsError),
+    #[error(transparent)]
+    Setup(#[from] SetupError),
+    #[error(transparent)]
+    TauriError(#[from] tauri::Error),
+    #[error(transparent)]
+    Crypto(#[from] CryptoError),
+}
+
+
+#[derive(Debug, ThisError, AsRefStr)]
+pub enum SaveCredentialsError {
+    #[error("Database error: {0}")]
+    DbError(#[from] SqlxError),
+    #[error("Encryption error: {0}")]
+    Crypto(#[from] CryptoError),
+    #[error(transparent)]
+    Session(#[from] GetCredentialsError),
+    #[error("App is locked")]
+    Locked,
+    #[error("Credential is temporary and cannot be saved")]
+    NotPersistent,
+    #[error("A credential with that name already exists")]
+    Duplicate,
+    // rekeying is fundamentally a save operation,
+    // but involves loading in order to re-save
+    #[error(transparent)]
+    LoadCredentials(#[from] LoadCredentialsError),
+}
+
+#[derive(Debug, ThisError, AsRefStr)]
+pub enum LoadCredentialsError {
+    #[error("Database error: {0}")]
+    DbError(#[from] SqlxError),
+    #[error("Invalid passphrase")] // pretty sure this is the only way decryption fails
+    Encryption(#[from] CryptoError),
+    #[error("Credentials not found")]
+    NoCredentials,
+    #[error("Could not decode credential data")]
+    InvalidData,
+    #[error(transparent)]
+    LoadKv(#[from] LoadKvError),
+}
+
+
+#[derive(Debug, ThisError, AsRefStr)]
+pub enum LoadKvError {
+    #[error("Database error: {0}")]
+    DbError(#[from] SqlxError),
+    #[error("Could not parse value from database: {0}")]
+    Invalid(#[from] serde_json::Error),
+}
+
+
 #[derive(Debug, ThisError, AsRefStr)]
 pub enum CryptoError {
     #[error(transparent)]
     Argon2(#[from] argon2::Error),
     #[error("Invalid passphrase")] // I think this is the only way decryption fails
     Aead(#[from] chacha20poly1305::aead::Error),
+    #[error("App is currently locked")]
+    Locked,
+    #[error("No passphrase has been specified")]
+    Empty,
 }
 
 
@@ -221,6 +329,7 @@ pub enum ClientInfoError {
     ParentPidNotFound,
     #[error("Found PID for parent process of client, but no corresponding process")]
     ParentProcessNotFound,
+    #[cfg(windows)]
     #[error("Could not determine PID of connected client")]
     WindowsError(#[from] windows::core::Error),
     #[error(transparent)]
@@ -320,10 +429,13 @@ impl Serialize for SerializeWrapper<&GetSessionTokenError> {
 }
 
 
-
 impl_serialize_basic!(SetupError);
 impl_serialize_basic!(GetCredentialsError);
 impl_serialize_basic!(ClientInfoError);
+impl_serialize_basic!(WindowError);
+impl_serialize_basic!(LockError);
+impl_serialize_basic!(SaveCredentialsError);
+impl_serialize_basic!(LoadCredentialsError);
 
 
 impl Serialize for HandlerError {

src-tauri/src/fixtures/kv.sql

@@ -0,0 +1,13 @@
+INSERT INTO kv (name, value)
+VALUES
+    -- b"hello world" (raw bytes)
+    ('test_bytes', X'68656C6C6F20776F726C64'),
+
+    -- b"\"hello world\"" (JSON string)
+    ('test_string', X'2268656C6C6F20776F726C6422'),
+
+    -- b"123" (JSON integer)
+    ('test_int', X'313233'),
+
+    -- b"true" (JSON bool)
+    ('test_bool', X'74727565')

src-tauri/src/ipc.rs

@@ -1,8 +1,12 @@
 use serde::{Serialize, Deserialize};
-use tauri::State;
+use sqlx::types::Uuid;
+use tauri::{AppHandle, State};
 
 use crate::config::AppConfig;
-use crate::credentials::{Session,BaseCredentials};
+use crate::credentials::{
+    AppSession,
+    CredentialRecord
+};
 use crate::errors::*;
 use crate::clientinfo::Client;
 use crate::state::AppState;
@@ -17,10 +21,37 @@ pub struct AwsRequestNotification {
 }
 
 
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct SshRequestNotification {
+    pub id: u64,
+    pub client: Client,
+    pub key_name: String,
+}
+
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(tag = "type")]
+pub enum RequestNotification {
+    Aws(AwsRequestNotification),
+    Ssh(SshRequestNotification),
+}
+
+impl RequestNotification {
+    pub fn new_aws(id: u64, client: Client, base: bool) -> Self {
+        Self::Aws(AwsRequestNotification {id, client, base})
+    }
+
+    pub fn new_ssh(id: u64, client: Client, key_name: String) -> Self {
+        Self::Ssh(SshRequestNotification {id, client, key_name})
+    }
+}
+
+
 #[derive(Debug, Serialize, Deserialize)]
 pub struct RequestResponse {
     pub id: u64,
     pub approval: Approval,
+    pub base: bool,
 }
 
 
@@ -43,25 +74,63 @@ pub async fn unlock(passphrase: String, app_state: State<'_, AppState>) -> Resul
 }
 
 
+#[tauri::command]
+pub async fn lock(app_state: State<'_, AppState>) -> Result<(), LockError> {
+    app_state.lock().await
+}
+
+
+#[tauri::command]
+pub async fn reset_session(app_state: State<'_, AppState>) -> Result<(), SaveCredentialsError> {
+    app_state.reset_session().await
+}
+
+
+#[tauri::command]
+pub async fn set_passphrase(passphrase: &str, app_state: State<'_, AppState>) -> Result<(), SaveCredentialsError> {
+    app_state.set_passphrase(passphrase).await
+}
+
+
 #[tauri::command]
 pub async fn get_session_status(app_state: State<'_, AppState>) -> Result<String, ()> {
-    let session = app_state.session.read().await;
+    let session = app_state.app_session.read().await;
     let status = match *session {
-        Session::Locked(_) => "locked".into(),
-        Session::Unlocked{..} => "unlocked".into(),
-        Session::Empty => "empty".into()
+        AppSession::Locked{..} => "locked".into(),
+        AppSession::Unlocked{..} => "unlocked".into(),
+        AppSession::Empty => "empty".into(),
     };
     Ok(status)
 }
 
 
 #[tauri::command]
-pub async fn save_credentials(
-    credentials: BaseCredentials,
-    passphrase: String,
+pub async fn signal_activity(app_state: State<'_, AppState>) -> Result<(), ()> {
+    app_state.signal_activity().await;
+    Ok(())
+}
+
+
+#[tauri::command]
+pub async fn save_credential(
+    record: CredentialRecord,
     app_state: State<'_, AppState>
-) -> Result<(), UnlockError> {
-    app_state.new_creds(credentials, &passphrase).await
+) -> Result<(), SaveCredentialsError> {
+    app_state.save_credential(record).await
+}
+
+
+#[tauri::command]
+pub async fn delete_credential(id: &str, app_state: State<'_, AppState>) -> Result<(), SaveCredentialsError> {
+    let id = Uuid::try_parse(id)
+        .map_err(|_| LoadCredentialsError::NoCredentials)?;
+    app_state.delete_credential(&id).await
+}
+
+
+#[tauri::command]
+pub async fn list_credentials(app_state: State<'_, AppState>) -> Result<Vec<CredentialRecord>, GetCredentialsError> {
+    app_state.list_credentials().await
 }
 
 
@@ -91,3 +160,9 @@ pub async fn launch_terminal(base: bool) -> Result<(), LaunchTerminalError> {
 pub async fn get_setup_errors(app_state: State<'_, AppState>) -> Result<Vec<String>, ()> {
     Ok(app_state.setup_errors.clone())
 }
+
+
+#[tauri::command]
+pub fn exit(app_handle: AppHandle) {
+    app_handle.exit(0)
+}

src-tauri/src/kv.rs

@@ -0,0 +1,210 @@
+use serde::Serialize;
+use serde::de::DeserializeOwned;
+use sqlx::SqlitePool;
+
+use crate::errors::*;
+
+
+pub async fn save<T>(pool: &SqlitePool, name: &str, value: &T) -> Result<(), sqlx::Error>
+    where T: Serialize + ?Sized
+{
+    let bytes = serde_json::to_vec(value).unwrap();
+    save_bytes(pool, name, &bytes).await
+}
+
+
+pub async fn save_bytes(pool: &SqlitePool, name: &str, bytes: &[u8]) -> Result<(), sqlx::Error> {
+    sqlx::query!(
+        "INSERT INTO kv (name, value) VALUES (?, ?)
+        ON CONFLICT(name) DO UPDATE SET value = excluded.value;",
+        name,
+        bytes,
+    ).execute(pool).await?;
+    Ok(())
+}
+
+
+pub async fn load<T>(pool: &SqlitePool, name: &str) -> Result<Option<T>, LoadKvError>
+    where T: DeserializeOwned
+{
+    let v = load_bytes(pool, name)
+        .await?
+        .map(|bytes| serde_json::from_slice(&bytes))
+        .transpose()?;
+    Ok(v)
+}
+
+
+pub async fn load_bytes(pool: &SqlitePool, name: &str) -> Result<Option<Vec<u8>>, sqlx::Error> {
+    sqlx::query!("SELECT name, value FROM kv WHERE name = ?", name)
+        .map(|row| row.value)
+        .fetch_optional(pool)
+        .await
+        .map(|o| o.flatten())
+}
+
+
+pub async fn delete(pool: &SqlitePool, name: &str) -> Result<(), sqlx::Error> {
+    sqlx::query!("DELETE FROM kv WHERE name = ?", name)
+        .execute(pool)
+        .await?;
+    Ok(())
+}
+
+
+pub async fn delete_multi(pool: &SqlitePool, names: &[&str]) -> Result<(), sqlx::Error> {    
+    let placeholder = names.iter()
+        .map(|_| "?")
+        .collect::<Vec<&str>>()
+        .join(",");
+    let query = format!("DELETE FROM kv WHERE name IN ({})", placeholder);
+    
+    let mut q = sqlx::query(&query);
+    for name in names {
+        q = q.bind(name);
+    }
+    q.execute(pool).await?;
+    Ok(())
+}
+
+
+macro_rules! load_bytes_multi {
+    (
+        $pool:expr,
+        $($name:literal),*
+    ) => {
+        // wrap everything up in an async block for easy short-circuiting...
+        async {
+            // ...returning a Result...
+            Ok::<_, sqlx::Error>(
+                //containing an Option...
+                Some(
+                    // containing a tuple...
+                    (
+                        // ...with one item for each repetition of $name
+                        $(
+                            // load_bytes returns Result<Option<_>>, the Result is handled by 
+                            // the ? and we match on the Option
+                            match crate::kv::load_bytes($pool, $name).await? {
+                                Some(v) => v,
+                                None => return Ok(None)
+                            },
+                        )*
+                    )
+                )
+            )
+        }
+    }
+}
+
+pub(crate) use load_bytes_multi;
+
+
+// macro_rules! load_multi {
+//     (
+//         $pool:expr,
+//         $($name:literal),*
+//     ) => {
+//         (|| {
+//             (
+//                 $(
+//                     match load(pool, $name)? {
+//                         Some(v) => v,
+//                         None => return Ok(None)
+//                     },
+//                 )*
+//             )
+//         })()
+//     }
+// }
+
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+
+    #[sqlx::test]
+    async fn test_save_bytes(pool: SqlitePool) {
+        save_bytes(&pool, "test_bytes", b"hello world").await
+            .expect("Failed to save bytes");
+    }
+
+
+    #[sqlx::test]
+    async fn test_save(pool: SqlitePool) {
+        save(&pool, "test_string", "hello world").await
+            .expect("Failed to save string");
+        save(&pool, "test_int", &123).await
+            .expect("Failed to save integer");
+        save(&pool, "test_bool", &true).await
+            .expect("Failed to save bool");
+    }
+
+
+    #[sqlx::test(fixtures("kv"))]
+    async fn test_load_bytes(pool: SqlitePool) {
+        let bytes = load_bytes(&pool, "test_bytes").await
+            .expect("Failed to load bytes")
+            .expect("Test data not found in database");
+
+        assert_eq!(bytes, Vec::from(b"hello world"));
+    }
+
+
+    #[sqlx::test(fixtures("kv"))]
+    async fn test_load(pool: SqlitePool) {
+        let string: String = load(&pool, "test_string").await
+            .expect("Failed to load string")
+            .expect("Test data not found in database");
+        assert_eq!(string, "hello world".to_string());
+
+        let integer: usize = load(&pool, "test_int").await
+            .expect("Failed to load integer")
+            .expect("Test data not found in database");
+        assert_eq!(integer, 123);
+
+        let boolean: bool = load(&pool, "test_bool").await
+            .expect("Failed to load boolean")
+            .expect("Test data not found in database");
+        assert_eq!(boolean, true);
+    }
+
+
+    #[sqlx::test(fixtures("kv"))]
+    async fn test_load_multi(pool: SqlitePool) {
+        let (bytes, boolean) = load_bytes_multi!(&pool, "test_bytes", "test_bool")
+            .await
+            .expect("Failed to load items")
+            .expect("Test data not found in database");
+
+        assert_eq!(bytes, Vec::from(b"hello world"));
+        assert_eq!(boolean, Vec::from(b"true"));
+    }
+
+
+    #[sqlx::test(fixtures("kv"))]
+    async fn test_delete(pool: SqlitePool) {
+        delete(&pool, "test_bytes").await
+            .expect("Failed to delete data");
+        
+        let loaded = load_bytes(&pool, "test_bytes").await
+            .expect("Failed to load data");
+        assert_eq!(loaded, None);
+    }
+
+
+    #[sqlx::test(fixtures("kv"))]
+    async fn test_delete_multi(pool: SqlitePool) {
+        delete_multi(&pool, &["test_bytes", "test_string"]).await
+            .expect("Failed to delete keys");
+
+        let bytes_opt = load_bytes(&pool, "test_bytes").await
+            .expect("Failed to load bytes");
+        assert_eq!(bytes_opt, None);
+
+        let string_opt = load_bytes(&pool, "test_string").await
+            .expect("Failed to load string");
+        assert_eq!(string_opt, None);
+    }
+}

src-tauri/src/lib.rs

@@ -5,7 +5,9 @@ mod credentials;
 pub mod errors;
 mod clientinfo;
 mod ipc;
+mod kv;
 mod state;
-mod server;
+pub mod server;
+mod shortcuts;
 mod terminal;
 mod tray;

src-tauri/src/main.rs

@@ -6,18 +6,19 @@
 use creddy::{
     app,
     cli,
-    errors::ErrorPopup,
+    errors::ShowError,
 };
 
 
 fn main() {
     let res = match cli::parser().get_matches().subcommand() {
         None | Some(("run", _)) => {
-            app::run().error_popup("Creddy failed to start");
+            app::run().error_popup("Creddy encountered an error");
             Ok(())
         },
         Some(("get", m)) => cli::get(m),
         Some(("exec", m)) => cli::exec(m),
+        Some(("shortcut", m)) => cli::invoke_shortcut(m),
         _ => unreachable!(),
     };
 

src-tauri/src/server.rs

@@ -1,184 +0,0 @@
-use std::time::Duration;
-
-#[cfg(windows)]
-use tokio::net::windows::named_pipe::{
-    NamedPipeServer,
-    ServerOptions,
-};
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
-use tokio::sync::oneshot;
-
-use serde::{Serialize, Deserialize};
-
-use tauri::{
-    AppHandle,
-    Manager,
-    async_runtime as rt,
-};
-
-use crate::errors::*;
-use crate::clientinfo::{self, Client};
-use crate::credentials::Credentials;
-use crate::ipc::{Approval, AwsRequestNotification};
-use crate::state::AppState;
-
-
-#[derive(Serialize, Deserialize)]
-pub enum Request {
-    GetAwsCredentials{ 
-        base: bool,
-    },
-}
-
-
-#[derive(Debug, Serialize, Deserialize)]
-pub enum Response {
-    Aws(Credentials)
-}
-
-
-pub struct Server {
-    listener: tokio::net::windows::named_pipe::NamedPipeServer,
-    app_handle: AppHandle,
-}
-
-impl Server {
-    pub fn start(app_handle: AppHandle) -> std::io::Result<()> {
-        let listener = ServerOptions::new()
-            .first_pipe_instance(true)
-            .create(r"\\.\pipe\creddy-requests")?;
-
-        let srv = Server {listener, app_handle};
-        rt::spawn(srv.serve());
-        Ok(())
-    }
-
-    async fn serve(mut self) {
-        loop {
-            if let Err(e) = self.try_serve().await {
-                eprintln!("Error accepting connection: {e}");
-            }
-        }
-    }
-
-    async fn try_serve(&mut self) -> std::io::Result<()> {
-        // connect() just waits for a client to connect, it doesn't return anything
-        self.listener.connect().await?;
-
-        // create a new pipe instance to listen for the next client, and swap it in
-        let new_listener = ServerOptions::new().create(r"\\.\pipe\creddy-requests")?;
-        let mut stream = std::mem::replace(&mut self.listener, new_listener);
-        let new_handle = self.app_handle.app_handle();
-        rt::spawn(async move {
-            let res = serde_json::to_string(
-                &handle(&mut stream, new_handle).await
-            ).unwrap();
-            if let Err(e) = stream.write_all(res.as_bytes()).await {
-                eprintln!("Error responding to request: {e}");
-            }
-        });
-
-        Ok(())
-    }
-}
-
-
-async fn handle(stream: &mut NamedPipeServer, app_handle: AppHandle) -> Result<Response, HandlerError> {
-    // read from stream until delimiter is reached
-    let mut buf: Vec<u8> = Vec::with_capacity(1024); // requests are small, 1KiB is more than enough
-    let mut n = 0;
-    loop {
-        n += stream.read_buf(&mut buf).await?;
-        if let Some(&b'\n') = buf.last() {
-            break;
-        }
-        else if n >= 1024 {
-            return Err(HandlerError::RequestTooLarge);
-        }
-    }
-
-    let client = clientinfo::get_client_parent(&stream)?;
-
-    let req: Request = serde_json::from_slice(&buf)?;
-    match req {
-        Request::GetAwsCredentials{ base } => get_aws_credentials(base, client, app_handle).await,
-        // etc
-    }
-}
-
-
-async fn get_aws_credentials(base: bool, client: Client, app_handle: AppHandle) -> Result<Response, HandlerError> {
-    let state = app_handle.state::<AppState>();
-
-    let main_window = app_handle.get_window("main").ok_or(HandlerError::NoMainWindow)?;
-    let is_currently_visible = main_window.is_visible()?;
-    let rehide_after = state.get_or_set_rehide(!is_currently_visible).await;
-
-    let (chan_send, chan_recv) = oneshot::channel();
-    let request_id = state.register_request(chan_send).await;
-
-    // if an error occurs in any of the following, we want to abort the operation
-    // but ? returns immediately, and we want to unregister the request before returning
-    // so we bundle it all up in an async block and return a Result so we can handle errors
-    let proceed = async {
-        let notification = AwsRequestNotification {id: request_id, client, base};
-        app_handle.emit_all("credentials-request", &notification)?;
-
-        if !main_window.is_visible()? {
-            main_window.unminimize()?;
-            main_window.show()?;
-        }
-        main_window.set_focus()?;
-
-        match chan_recv.await {
-            Ok(Approval::Approved) => {
-                if base {
-                    let creds = state.base_creds_cloned().await?;
-                    Ok(Response::Aws(Credentials::Base(creds)))
-                }
-                else {
-                    let creds = state.session_creds_cloned().await?;
-                    Ok(Response::Aws(Credentials::Session(creds)))
-                }
-            },
-            Ok(Approval::Denied) => Err(HandlerError::Denied),
-            Err(_e) => Err(HandlerError::Internal),
-        }
-    };
-
-    let result = match proceed.await {
-        Ok(r) => Ok(r),
-        Err(e) => {
-            state.unregister_request(request_id).await;
-            Err(e)
-        }
-    };
-
-    rt::spawn(
-        handle_rehide(rehide_after, app_handle.app_handle())
-    );
-    result
-}
-
-
-async fn handle_rehide(rehide_after: bool, app_handle: AppHandle) {
-    let state = app_handle.state::<AppState>();
-    let delay = {
-        let config = state.config.read().await;
-        Duration::from_millis(config.rehide_ms)
-    };
-    tokio::time::sleep(delay).await;
-
-    // if there are no other pending requests, set rehide status back to None
-    if state.req_count().await == 0 {
-        state.clear_rehide().await;
-        // and hide the window if necessary
-        if rehide_after {
-            app_handle.get_window("main").map(|w| {
-                if let Err(e) = w.hide() {
-                    eprintln!("{e}");
-                }
-            });
-        }
-    }
-}

src-tauri/src/server/mod.rs

@@ -0,0 +1,170 @@
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::sync::oneshot;
+
+use serde::{Serialize, Deserialize};
+
+use tauri::{AppHandle, Manager};
+
+use crate::errors::*;
+use crate::clientinfo::{self, Client};
+use crate::credentials::{
+    AwsBaseCredential,
+    AwsSessionCredential,
+};
+use crate::ipc::{Approval, RequestNotification};
+use crate::state::AppState;
+use crate::shortcuts::{self, ShortcutAction};
+
+#[cfg(windows)]
+mod server_win;
+#[cfg(windows)]
+pub use server_win::Server;
+#[cfg(windows)]
+use server_win::Stream;
+
+#[cfg(unix)]
+mod server_unix;
+#[cfg(unix)]
+pub use server_unix::Server;
+#[cfg(unix)]
+use server_unix::Stream;
+
+pub mod ssh_agent;
+
+
+#[derive(Serialize, Deserialize)]
+pub enum Request {
+    GetAwsCredentials{ 
+        base: bool,
+    },
+    InvokeShortcut(ShortcutAction),
+}
+
+
+#[derive(Debug, Serialize, Deserialize)]
+pub enum Response {
+    AwsBase(AwsBaseCredential),
+    AwsSession(AwsSessionCredential),
+    Empty,
+}
+
+
+struct CloseWaiter<'s> {
+    stream: &'s mut Stream,
+}
+
+impl<'s> CloseWaiter<'s> {
+    async fn wait_for_close(&mut self) -> std::io::Result<()> {
+        let mut buf = [0u8; 8];
+        loop {
+            match self.stream.read(&mut buf).await {
+                Ok(0) => break Ok(()),
+                Ok(_) => (),
+                Err(e) => break Err(e),
+            }
+        }
+    }
+}
+
+
+async fn handle(mut stream: Stream, app_handle: AppHandle, client_pid: u32) -> Result<(), HandlerError> 
+{
+    // read from stream until delimiter is reached
+    let mut buf: Vec<u8> = Vec::with_capacity(1024); // requests are small, 1KiB is more than enough
+    let mut n = 0;
+    loop {
+        n += stream.read_buf(&mut buf).await?;
+        if let Some(&b'\n') = buf.last() {
+            break;
+        }
+        else if n >= 1024 {
+            return Err(HandlerError::RequestTooLarge);
+        }
+    }
+
+    let client = clientinfo::get_process_parent_info(client_pid)?;
+    let waiter = CloseWaiter { stream: &mut stream };
+
+    let req: Request = serde_json::from_slice(&buf)?;
+    let res = match req {
+        Request::GetAwsCredentials{ base } => get_aws_credentials(
+            base, client, app_handle, waiter
+        ).await,
+        Request::InvokeShortcut(action) => invoke_shortcut(action).await,
+    };
+
+    // doesn't make sense to send the error to the client if the client has already left
+    if let Err(HandlerError::Abandoned) = res {
+        return Err(HandlerError::Abandoned);
+    }
+
+    let res = serde_json::to_vec(&res).unwrap();
+    stream.write_all(&res).await?;
+    Ok(())
+}
+
+
+async fn invoke_shortcut(action: ShortcutAction) -> Result<Response, HandlerError> {
+    shortcuts::exec_shortcut(action);
+    Ok(Response::Empty)
+}
+
+
+async fn get_aws_credentials(
+    base: bool,
+    client: Client,
+    app_handle: AppHandle,
+    mut waiter: CloseWaiter<'_>,
+) -> Result<Response, HandlerError> {
+    let state = app_handle.state::<AppState>();
+    let rehide_ms = {
+        let config = state.config.read().await;
+        config.rehide_ms
+    };
+    let lease = state.acquire_visibility_lease(rehide_ms).await
+        .map_err(|_e| HandlerError::NoMainWindow)?; // automate this conversion eventually?
+
+    let (chan_send, chan_recv) = oneshot::channel();
+    let request_id = state.register_request(chan_send).await;
+
+    // if an error occurs in any of the following, we want to abort the operation
+    // but ? returns immediately, and we want to unregister the request before returning
+    // so we bundle it all up in an async block and return a Result so we can handle errors
+    let proceed = async {
+        let notification = RequestNotification::new_aws(request_id, client, base);
+        app_handle.emit("credential-request", &notification)?;
+
+        let response = tokio::select! {
+            r = chan_recv => r?,
+            _ = waiter.wait_for_close() => {
+                app_handle.emit("request-cancelled", request_id)?;
+                return Err(HandlerError::Abandoned);
+            },
+        };
+
+        match response.approval {
+            Approval::Approved => {
+                if response.base {
+                    let creds = state.get_aws_base("default").await?;
+                    Ok(Response::AwsBase(creds))
+                }
+                else {
+                    let creds = state.get_aws_session("default").await?;
+                    Ok(Response::AwsSession(creds.clone()))
+                }
+            },
+            Approval::Denied => Err(HandlerError::Denied),
+        }
+    };
+
+    let result = match proceed.await {
+        Ok(r) => Ok(r),
+        Err(e) => {
+            state.unregister_request(request_id).await;
+            Err(e)
+        }
+    };
+
+    lease.release();
+    result
+}

src-tauri/src/server/server_unix.rs

@@ -0,0 +1,58 @@
+use std::io::ErrorKind;
+use tokio::net::{UnixListener, UnixStream};
+use tauri::{
+    AppHandle,
+    async_runtime as rt,
+};
+
+use crate::errors::*;
+
+
+pub type Stream = UnixStream;
+
+
+pub struct Server {
+    listener: UnixListener,
+    app_handle: AppHandle,
+}
+
+impl Server {
+    pub fn start(app_handle: AppHandle) -> std::io::Result<()> {
+        match std::fs::remove_file("/tmp/creddy.sock") {
+            Ok(_) => (),
+            Err(e) if e.kind() == ErrorKind::NotFound => (),
+            Err(e) => return Err(e),
+        }
+
+        let listener = UnixListener::bind("/tmp/creddy.sock")?;
+        let srv = Server { listener, app_handle };
+        rt::spawn(srv.serve());
+        Ok(())
+    }
+
+    async fn serve(self) {
+        loop {
+            self.try_serve()
+                .await
+                .error_print_prefix("Error accepting request: ");
+        }
+    }
+
+    async fn try_serve(&self) -> Result<(), HandlerError> {
+        let (stream, _addr) = self.listener.accept().await?;
+        let new_handle = self.app_handle.clone();
+        let client_pid = get_client_pid(&stream)?;
+        rt::spawn(async move {
+            super::handle(stream, new_handle, client_pid)
+                .await
+                .error_print_prefix("Error responding to request: ");
+        });
+        Ok(())
+    }
+}
+
+
+fn get_client_pid(stream: &UnixStream) -> std::io::Result<u32> {
+    let cred = stream.peer_cred()?;
+    Ok(cred.pid().unwrap() as u32)
+}

src-tauri/src/server/server_win.rs

@@ -0,0 +1,74 @@
+use tokio::net::windows::named_pipe::{
+    NamedPipeServer,
+    ServerOptions,
+};
+
+use tauri::{AppHandle, Manager};
+
+use windows::Win32:: {
+    Foundation::HANDLE,
+    System::Pipes::GetNamedPipeClientProcessId,
+};
+
+use std::os::windows::io::AsRawHandle;
+
+use tauri::async_runtime as rt;
+
+use crate::errors::*;
+
+
+// used by parent module
+pub type Stream = NamedPipeServer;
+
+
+pub struct Server {
+    listener: NamedPipeServer,
+    app_handle: AppHandle,
+}
+
+impl Server {
+    pub fn start(app_handle: AppHandle) -> std::io::Result<()> {
+        let listener = ServerOptions::new()
+            .first_pipe_instance(true)
+            .create(r"\\.\pipe\creddy-requests")?;
+
+        let srv = Server {listener, app_handle};
+        rt::spawn(srv.serve());
+        Ok(())
+    }
+
+    async fn serve(mut self) {
+        loop {
+            if let Err(e) = self.try_serve().await {
+                eprintln!("Error accepting connection: {e}");
+            }
+        }
+    }
+
+    async fn try_serve(&mut self) -> Result<(), HandlerError> {
+        // connect() just waits for a client to connect, it doesn't return anything
+        self.listener.connect().await?;
+
+        // create a new pipe instance to listen for the next client, and swap it in
+        let new_listener = ServerOptions::new().create(r"\\.\pipe\creddy-requests")?;
+        let stream = std::mem::replace(&mut self.listener, new_listener);
+        let new_handle = self.app_handle.clone();
+        let client_pid = get_client_pid(&stream)?;
+        rt::spawn(async move {
+            super::handle(stream, new_handle, client_pid)
+                .await
+                .error_print_prefix("Error responding to request: ");
+        });
+
+        Ok(())
+    }
+}
+
+
+fn get_client_pid(pipe: &NamedPipeServer) -> Result<u32, ClientInfoError> {
+    let raw_handle = pipe.as_raw_handle();
+    let mut pid = 0u32;
+    let handle = HANDLE(raw_handle as _);
+    unsafe { GetNamedPipeClientProcessId(handle, &mut pid as *mut u32)? };
+    Ok(pid)
+}

src-tauri/src/server/ssh_agent.rs

@@ -0,0 +1,77 @@
+use signature::Signer;
+use ssh_agent_lib::agent::{Agent, Session};
+use ssh_agent_lib::proto::message::Message;
+use ssh_key::public::PublicKey;
+use ssh_key::private::PrivateKey;
+use tokio::net::UnixListener;
+
+
+struct SshAgent;
+
+impl std::default::Default for SshAgent {
+    fn default() -> Self {
+        SshAgent {}
+    }
+}
+
+#[ssh_agent_lib::async_trait]
+impl Session for SshAgent {
+    async fn handle(&mut self, message: Message) -> Result<Message, Box<dyn std::error::Error>> {
+        println!("Received message");
+        match message {
+            Message::RequestIdentities => {
+                let p = std::path::PathBuf::from("/home/joe/.ssh/id_ed25519.pub");
+                let pubkey = PublicKey::read_openssh_file(&p).unwrap();
+                let id = ssh_agent_lib::proto::message::Identity {
+                    pubkey_blob: pubkey.to_bytes().unwrap(),
+                    comment: pubkey.comment().to_owned(),
+                };
+                Ok(Message::IdentitiesAnswer(vec![id]))
+            },
+            Message::SignRequest(req) => {
+                println!("Received sign request");
+                let mut req_bytes = vec![13];
+                encode_string(&mut req_bytes, &req.pubkey_blob);
+                encode_string(&mut req_bytes, &req.data);
+                req_bytes.extend(req.flags.to_be_bytes());
+                std::fs::File::create("/tmp/signreq").unwrap().write(&req_bytes).unwrap();
+
+                let p = std::path::PathBuf::from("/home/joe/.ssh/id_ed25519");
+                let passphrase = std::env::var("PRIVKEY_PASSPHRASE").unwrap();
+                let privkey = PrivateKey::read_openssh_file(&p)
+                    .unwrap()
+                    .decrypt(passphrase.as_bytes())
+                    .unwrap();
+
+
+
+                let sig = Signer::sign(&privkey, &req.data);
+                use std::io::Write;
+                std::fs::File::create("/tmp/sig").unwrap().write(sig.as_bytes()).unwrap();
+
+                let mut payload = Vec::with_capacity(128);
+                encode_string(&mut payload, "ssh-ed25519".as_bytes());
+                encode_string(&mut payload, sig.as_bytes());
+                println!("Payload length: {}", payload.len());
+                std::fs::File::create("/tmp/payload").unwrap().write(&payload).unwrap();
+                Ok(Message::SignResponse(payload))
+            },
+            _ => Ok(Message::Failure),
+        }
+    }
+}
+
+
+fn encode_string(buf: &mut Vec<u8>, s: &[u8]) {
+    let len = s.len() as u32;
+    buf.extend(len.to_be_bytes());
+    buf.extend(s);
+}
+
+
+pub async fn run() {
+    let socket = "/tmp/creddy-agent.sock";
+    let _ = std::fs::remove_file(socket);
+    let listener = UnixListener::bind(socket).unwrap();
+    SshAgent.listen(listener).await.unwrap();
+}

src-tauri/src/shortcuts.rs

@@ -1,12 +1,15 @@
 use serde::{Serialize, Deserialize};
 
-use tauri::{
-    AppHandle,
-    Manager,
+use tauri::async_runtime as rt;
+
+use tauri_plugin_global_shortcut::{
+    GlobalShortcutExt,
+    Error as ShortcutError,
 };
 
-use crate::app::APP;
+use crate::app::{self, APP};
 use crate::config::HotkeysConfig;
+use crate::errors::*;
 use crate::terminal;
 
 
@@ -19,31 +22,46 @@ pub enum ShortcutAction {
 
 pub fn exec_shortcut(action: ShortcutAction) {
     match action {
-        ShowWindow => {
+        ShortcutAction::LaunchTerminal => launch_terminal(),
+        ShortcutAction::ShowWindow => {
             let app = APP.get().unwrap();
-            app.get_window("main").map(|w| w.show());
+            app::show_main_window(app)
+                .error_popup("Failed to show Creddy");
         },
-        LaunchTerminal => terminal::launch(false),
     }
 }
 
 
-pub fn register_hotkeys(hotkeys: &HotkeysConfig) -> tauri::Result<()> {
+fn launch_terminal() {
+    rt::spawn(async {
+        terminal::launch(false)
+            .await
+            .error_popup("Failed to launch terminal")
+    });
+}
+
+
+pub fn register_hotkeys(hotkeys: &HotkeysConfig) -> Result<(), ShortcutError> {
     let app = APP.get().unwrap();
-    let mut manager = app.global_shortcut_manager();
-    manager.unregister_all()?;
+    let shortcuts = app.global_shortcut();
+    shortcuts.unregister_all([
+        hotkeys.show_window.keys.as_str(),
+        hotkeys.launch_terminal.keys.as_str(),
+    ])?;
 
     if hotkeys.show_window.enabled {
-        manager.register(
-            hotkeys.show_window.keys,
-            || exec_shortcut(ShortcutAction::ShowWindow)
+        shortcuts.on_shortcut(
+            hotkeys.show_window.keys.as_str(),
+            |app, _shortcut, _event| {
+                app::show_main_window(app).error_popup("Failed to show Creddy")
+            }
         )?;
     }
 
     if hotkeys.launch_terminal.enabled {
-        manager.register(
-            &hotkeys.launch_terminal.keys,
-            || exec_shortcut(ShortcutAction::LaunchTerminal)
+        shortcuts.on_shortcut(
+            hotkeys.launch_terminal.keys.as_str(),
+            |_app, _shortcut, _event| launch_terminal()
         )?;
     }
 

src-tauri/src/state.rs

@@ -1,59 +1,184 @@
 use std::collections::HashMap;
+use std::time::Duration;
+use time::OffsetDateTime;
 
 use tokio::{
-    sync::RwLock,
-    sync::oneshot::Sender,
+    sync::{RwLock, RwLockReadGuard},
+    sync::oneshot::{self, Sender},
 };
 use sqlx::SqlitePool;
+use sqlx::types::Uuid;
+use tauri::{
+    Manager,
+    async_runtime as rt,
+};
 
+use crate::app;
 use crate::credentials::{
-    Session,
-    BaseCredentials,
-    SessionCredentials,
+    AppSession,
+    AwsSessionCredential,
 };
 use crate::{config, config::AppConfig};
-use crate::ipc::{self, Approval};
+use crate::credentials::{
+    AwsBaseCredential,
+    CredentialRecord,
+    PersistentCredential
+};
+use crate::ipc::{self, RequestResponse};
 use crate::errors::*;
+use crate::shortcuts;
+
+
+#[derive(Debug)]
+struct Visibility {
+    leases: usize,
+    original: Option<bool>,
+}
+
+impl Visibility {
+    fn new() -> Self {
+        Visibility { leases: 0, original: None }
+    }
+
+    fn acquire(&mut self, delay_ms: u64) -> Result<VisibilityLease, WindowError> {
+        let app = crate::app::APP.get().unwrap();
+        let window = app.get_webview_window("main")
+            .ok_or(WindowError::NoMainWindow)?;
+
+        self.leases += 1;
+        // `original` represents the visibility of the window before any leases were acquired
+        // None means we don't know, Some(false) means it was previously hidden,
+        // Some(true) means it was previously visible
+        let is_visible = window.is_visible()?;
+        if self.original.is_none() {
+            self.original = Some(is_visible);
+        }
+
+        let state = app.state::<AppState>();
+        if is_visible && state.desktop_is_gnome {
+            // Gnome has a really annoying "focus-stealing prevention" behavior means we
+            // can't just pop up when the window is already visible, so to work around it
+            // we hide and then immediately unhide the window
+            window.hide()?;
+        }
+        app::show_main_window(&app)?;
+        window.set_focus()?;
+
+        let (tx, rx) = oneshot::channel();
+        let lease = VisibilityLease { notify: tx };
+
+        let delay = Duration::from_millis(delay_ms);
+        rt::spawn(async move {
+            // We don't care if it's an error; lease being dropped should be handled identically
+            let _ = rx.await;
+            tokio::time::sleep(delay).await;
+            // we can't use `self` here because we would have to move it into the async block
+            let state = app.state::<AppState>();
+            let mut visibility = state.visibility.write().await;
+            visibility.leases -= 1;
+            if visibility.leases == 0 {
+                if let Some(false) = visibility.original {
+                    app::hide_main_window(app).error_print();
+                }
+                visibility.original = None;
+            }
+        });
+
+        Ok(lease)
+    }
+}
+
+pub struct VisibilityLease {
+    notify: Sender<()>,
+}
+
+impl VisibilityLease {
+    pub fn release(self) {
+        rt::spawn(async move {
+            if let Err(_) = self.notify.send(()) {
+                eprintln!("Error releasing visibility lease")
+            }
+        });
+    }
+}
 
 
 #[derive(Debug)]
 pub struct AppState {
     pub config: RwLock<AppConfig>,
-    pub session: RwLock<Session>,
+    pub app_session: RwLock<AppSession>,
+    pub aws_session: RwLock<Option<AwsSessionCredential>>,
+    pub last_activity: RwLock<OffsetDateTime>,
     pub request_count: RwLock<u64>,
-    pub waiting_requests: RwLock<HashMap<u64, Sender<Approval>>>,
-    pub current_rehide_status: RwLock<Option<bool>>,
+    pub waiting_requests: RwLock<HashMap<u64, Sender<RequestResponse>>>,
     pub pending_terminal_request: RwLock<bool>,
-    // setup_errors is never modified and so doesn't need to be wrapped in RwLock
+    // these are never modified and so don't need to be wrapped in RwLocks
     pub setup_errors: Vec<String>,
+    pub desktop_is_gnome: bool,
     pool: sqlx::SqlitePool,
+    visibility: RwLock<Visibility>,
 }
 
 impl AppState {
     pub fn new(
         config: AppConfig,
-        session: Session,
+        app_session: AppSession,
         pool: SqlitePool,
         setup_errors: Vec<String>,
+        desktop_is_gnome: bool,
     ) -> AppState {
         AppState {
             config: RwLock::new(config),
-            session: RwLock::new(session),
+            app_session: RwLock::new(app_session),
+            aws_session: RwLock::new(None),
+            last_activity: RwLock::new(OffsetDateTime::now_utc()),
             request_count: RwLock::new(0),
             waiting_requests: RwLock::new(HashMap::new()),
-            current_rehide_status: RwLock::new(None),
             pending_terminal_request: RwLock::new(false),
             setup_errors,
+            desktop_is_gnome,
             pool,
+            visibility: RwLock::new(Visibility::new()),
         }
     }
 
-    pub async fn new_creds(&self, base_creds: BaseCredentials, passphrase: &str) -> Result<(), UnlockError> {
-        let locked = base_creds.encrypt(passphrase)?;
-        // do this first so that if it fails we don't save bad credentials
-        self.new_session(base_creds).await?;
-        locked.save(&self.pool).await?;
+    pub async fn save_credential(&self, record: CredentialRecord) -> Result<(), SaveCredentialsError> {
+        let session = self.app_session.read().await;
+        let crypto = session.try_get_crypto()?;
+        record.save(crypto, &self.pool).await
+    }
 
+    pub async fn delete_credential(&self, id: &Uuid) -> Result<(), SaveCredentialsError> {
+        sqlx::query!("DELETE FROM credentials WHERE id = ?", id)
+            .execute(&self.pool)
+            .await?;
+        Ok(())
+    }
+
+    pub async fn list_credentials(&self) -> Result<Vec<CredentialRecord>, GetCredentialsError> {
+        let session = self.app_session.read().await;
+        let crypto = session.try_get_crypto()?;
+        let list = CredentialRecord::list(crypto, &self.pool).await?;
+        Ok(list)
+    }
+
+    pub async fn set_passphrase(&self, passphrase: &str) -> Result<(), SaveCredentialsError> {
+        let mut cur_session = self.app_session.write().await;
+        if let AppSession::Locked {..} = *cur_session {
+            return Err(SaveCredentialsError::Locked);
+        }
+
+        let new_session = AppSession::new(passphrase)?;
+        if let AppSession::Unlocked {salt: _, ref crypto} = *cur_session {
+            CredentialRecord::rekey(
+                crypto,
+                new_session.try_get_crypto().expect("AppSession::new() should always return Unlocked"),
+                &self.pool,
+            ).await?;
+        }
+
+        new_session.save(&self.pool).await?;
+        *cur_session = new_session;
         Ok(())
     }
 
@@ -69,7 +194,7 @@ impl AppState {
         if new_config.hotkeys.show_window != live_config.hotkeys.show_window
             || new_config.hotkeys.launch_terminal != live_config.hotkeys.launch_terminal
         {
-            config::register_hotkeys(&new_config.hotkeys)?;
+            shortcuts::register_hotkeys(&new_config.hotkeys)?;
         }
 
         new_config.save(&self.pool).await?;
@@ -77,7 +202,7 @@ impl AppState {
         Ok(())
     }
 
-    pub async fn register_request(&self, sender: Sender<Approval>) -> u64 {
+    pub async fn register_request(&self, sender: Sender<RequestResponse>) -> u64 {
         let count = {
             let mut c = self.request_count.write().await;
             *c += 1;
@@ -94,75 +219,90 @@ impl AppState {
         waiting_requests.remove(&id);
     }
 
-    pub async fn req_count(&self) -> usize {
-        let waiting_requests = self.waiting_requests.read().await;
-        waiting_requests.len()
-    }
-
-    pub async fn get_or_set_rehide(&self, new_value: bool) -> bool {
-        let mut rehide = self.current_rehide_status.write().await;
-        match *rehide {
-            Some(original) => original,
-            None => {
-                *rehide = Some(new_value);
-                new_value
-            }
-        }
-    }
-
-    pub async fn clear_rehide(&self) {
-        let mut rehide = self.current_rehide_status.write().await;
-        *rehide = None;
+    pub async fn acquire_visibility_lease(&self, delay: u64) -> Result<VisibilityLease, WindowError> {
+        let mut visibility = self.visibility.write().await;
+        visibility.acquire(delay)
     }
 
     pub async fn send_response(&self, response: ipc::RequestResponse) -> Result<(), SendResponseError> {
-        if let Approval::Approved = response.approval {
-            let mut session = self.session.write().await;
-            session.renew_if_expired().await?;
-        }
-
         let mut waiting_requests = self.waiting_requests.write().await;
         waiting_requests
             .remove(&response.id)
             .ok_or(SendResponseError::NotFound)?
-            .send(response.approval)
+            .send(response)
             .map_err(|_| SendResponseError::Abandoned)
     }
 
     pub async fn unlock(&self, passphrase: &str) -> Result<(), UnlockError> {
-        let base_creds = match *self.session.read().await {
-            Session::Empty => {return Err(UnlockError::NoCredentials);},
-            Session::Unlocked{..} => {return Err(UnlockError::NotLocked);},
-            Session::Locked(ref locked) => locked.decrypt(passphrase)?,
-        };
-        // Read lock is dropped here, so this doesn't deadlock
-        self.new_session(base_creds).await?;
+        let mut session = self.app_session.write().await;
+        session.unlock(passphrase)
+    }
 
+    pub async fn lock(&self) -> Result<(), LockError> {
+        let mut session = self.app_session.write().await;
+        match *session {
+            AppSession::Empty => Err(LockError::NotUnlocked),
+            AppSession::Locked{..} => Err(LockError::NotUnlocked),
+            AppSession::Unlocked{..} => {
+                *session = AppSession::load(&self.pool).await?;
+
+                let app_handle = app::APP.get().unwrap();
+                app_handle.emit("locked", None::<usize>)?;
+
+                Ok(())
+            }
+        }
+    }
+
+    pub async fn reset_session(&self) -> Result<(), SaveCredentialsError> {
+        let mut session = self.app_session.write().await;
+        session.reset(&self.pool).await?;
+        sqlx::query!("DELETE FROM credentials").execute(&self.pool).await?;
         Ok(())
     }
 
-    pub async fn is_unlocked(&self) -> bool {
-        let session = self.session.read().await;
-        matches!(*session, Session::Unlocked{..})
+    pub async fn get_aws_base(&self, name: &str) -> Result<AwsBaseCredential, GetCredentialsError> {
+        let app_session = self.app_session.read().await;
+        let crypto = app_session.try_get_crypto()?;
+        let creds = AwsBaseCredential::load_by_name(name, crypto, &self.pool).await?;
+        Ok(creds)
     }
 
-    pub async fn base_creds_cloned(&self) -> Result<BaseCredentials, GetCredentialsError> {
-        let app_session = self.session.read().await;
-        let (base, _session) = app_session.try_get()?;
-        Ok(base.clone())
+    pub async fn get_aws_session(&self, name: &str) -> Result<RwLockReadGuard<'_, AwsSessionCredential>, GetCredentialsError> {
+        // yes, this sometimes results in double-fetching base credentials from disk
+        // I'm done trying to be optimal
+        {
+            let mut aws_session = self.aws_session.write().await;
+            if aws_session.is_none() || aws_session.as_ref().unwrap().is_expired() {
+                let base_creds = self.get_aws_base(name).await?;
+                *aws_session = Some(AwsSessionCredential::from_base(&base_creds).await?);
+            }
+        }
+
+        // we know this is safe, because we juse made sure of it
+        let s = RwLockReadGuard::map(self.aws_session.read().await, |opt| opt.as_ref().unwrap());
+        Ok(s)
     }
 
-    pub async fn session_creds_cloned(&self) -> Result<SessionCredentials, GetCredentialsError> {
-        let app_session = self.session.read().await;
-        let (_bsae, session) = app_session.try_get()?;
-        Ok(session.clone())
+    pub async fn signal_activity(&self) {
+        let mut last_activity = self.last_activity.write().await;
+        *last_activity = OffsetDateTime::now_utc();
     }
 
-    async fn new_session(&self, base: BaseCredentials) -> Result<(), GetSessionError> {
-        let session = SessionCredentials::from_base(&base).await?;
-        let mut app_session = self.session.write().await;
-        *app_session = Session::Unlocked {base, session};
-        Ok(())
+    pub async fn should_auto_lock(&self) -> bool {
+        let config = self.config.read().await;
+        if !config.auto_lock || self.is_locked().await {
+            return false;
+        }
+
+        let last_activity = self.last_activity.read().await;
+        let elapsed = OffsetDateTime::now_utc() - *last_activity;
+        elapsed >= config.lock_after
+    }
+
+    pub async fn is_locked(&self) -> bool {
+        let session = self.app_session.read().await;
+        matches!(*session, AppSession::Locked {..})
     }
 
     pub async fn register_terminal_request(&self) -> Result<(), ()> {
@@ -182,3 +322,36 @@ impl AppState {
         *req = false;
     }
 }
+
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::credentials::Crypto;
+    use sqlx::types::Uuid;
+
+
+    fn test_state(pool: SqlitePool) -> AppState {
+        let salt = [0u8; 32];
+        let crypto = Crypto::fixed();
+        AppState::new(
+            AppConfig::default(),
+            AppSession::Unlocked { salt, crypto },
+            pool,
+            vec![],
+            false,
+        )
+    }
+
+
+    #[sqlx::test(fixtures("./credentials/fixtures/aws_credentials.sql"))]
+    fn test_delete_credential(pool: SqlitePool) {
+        let state = test_state(pool);
+        let id = Uuid::try_parse("00000000-0000-0000-0000-000000000000").unwrap();
+        state.delete_credential(&id).await.unwrap();
+
+        // ensure delete-cascade went through correctly
+        let res = AwsBaseCredential::load(&id, &Crypto::fixed(), &state.pool).await;
+        assert!(matches!(res, Err(LoadCredentialsError::NoCredentials)));
+    }
+}

src-tauri/src/terminal.rs

@@ -1,6 +1,8 @@
 use std::process::Command;
+use std::time::Duration;
 
 use tauri::Manager;
+use tokio::time::sleep;
 
 use crate::app::APP;
 use crate::errors::*;
@@ -23,48 +25,42 @@ pub async fn launch(use_base: bool) -> Result<(), LaunchTerminalError> {
         cmd
     };
 
-    // if session is unlocked or empty, wait for credentials from frontend
-    if !state.is_unlocked().await {
-        app.emit_all("launch-terminal-request", ())?;
-        let window = app.get_window("main")
-            .ok_or(LaunchTerminalError::NoMainWindow)?;
-        if !window.is_visible()? {
-            window.unminimize()?;
-            window.show()?;
-        }
-        window.set_focus()?;
+    // if session is locked, wait for credentials from frontend
+    if state.is_locked().await {
+        let lease = state.acquire_visibility_lease(0).await
+            .map_err(|_e| LaunchTerminalError::NoMainWindow)?; // automate conversion eventually?
 
         let (tx, rx) = tokio::sync::oneshot::channel();
-        app.once_global("credentials-event", move |e| {
-            let success = match e.payload() {
-                Some("\"unlocked\"") | Some("\"entered\"") => true,
-                _ => false,
-            };
-            let _ = tx.send(success);
+        app.once("unlocked", move |_| {
+            let _ = tx.send(());
         });
 
-        if !rx.await.unwrap_or(false) {
-            state.unregister_terminal_request().await;
-            return Ok(()); // request was canceled by user
+        let timeout = Duration::from_secs(60);
+        tokio::select! {
+            // if the frontend is unlocked within 60 seconds, release visibility lock and proceed
+            _ = rx => lease.release(),
+            // otherwise, dump this request, but return Ok so we don't get an error popup
+            _ = sleep(timeout) => {
+                state.unregister_terminal_request().await;
+                eprintln!("WARNING: Request to launch terminal timed out after 60 seconds.");
+                return Ok(());
+            },
         }
     }
 
-    // more lock-management
-    {
-        let app_session = state.session.read().await;
-        // session should really be unlocked at this point, but if the frontend misbehaves
-        // (i.e. lies about unlocking) we could end up here with a locked session
-        // this will result in an error popup to the user (see main hotkey handler)
-        let (base_creds, session_creds) = app_session.try_get()?;
-        if use_base {
-            cmd.env("AWS_ACCESS_KEY_ID", &base_creds.access_key_id);
-            cmd.env("AWS_SECRET_ACCESS_KEY", &base_creds.secret_access_key);
-        }
-        else {
-            cmd.env("AWS_ACCESS_KEY_ID", &session_creds.access_key_id);
-            cmd.env("AWS_SECRET_ACCESS_KEY", &session_creds.secret_access_key);
-            cmd.env("AWS_SESSION_TOKEN", &session_creds.session_token);
-        }
+    // session should really be unlocked at this point, but if the frontend misbehaves
+    // (i.e. lies about unlocking) we could end up here with a locked session
+    // this will result in an error popup to the user (see main hotkey handler)
+    if use_base {
+        let base_creds = state.get_aws_base("default").await?;
+        cmd.env("AWS_ACCESS_KEY_ID", &base_creds.access_key_id);
+        cmd.env("AWS_SECRET_ACCESS_KEY", &base_creds.secret_access_key);
+    }
+    else {
+        let session_creds = state.get_aws_session("default").await?;
+        cmd.env("AWS_ACCESS_KEY_ID", &session_creds.access_key_id);
+        cmd.env("AWS_SECRET_ACCESS_KEY", &session_creds.secret_access_key);
+        cmd.env("AWS_SESSION_TOKEN", &session_creds.session_token);
     }
 
     let res = match cmd.spawn() {

src-tauri/src/tray.rs

@@ -1,36 +1,49 @@
 use tauri::{
+    App,
     AppHandle,
     Manager,
-    SystemTray,
-    SystemTrayEvent,
-    SystemTrayMenu,
-    CustomMenuItem,
+    async_runtime as rt,
+};
+use tauri::menu::{
+    MenuBuilder,
+    MenuEvent,
+    MenuItemBuilder,
 };
 
+use crate::app;
+use crate::state::AppState;
 
-pub fn create() -> SystemTray {
-    let show = CustomMenuItem::new("show".to_string(), "Show");
-    let quit = CustomMenuItem::new("exit".to_string(), "Exit");
 
-    let menu = SystemTrayMenu::new()
-        .add_item(show)
-        .add_item(quit);
+pub fn setup(app: &App) -> tauri::Result<()> {
+    let show_hide = MenuItemBuilder::with_id("show_hide", "Show").build(app)?;
+    let exit = MenuItemBuilder::with_id("exit", "Exit").build(app)?;
 
-    SystemTray::new().with_menu(menu)
+    let menu = MenuBuilder::new(app)
+        .items(&[&show_hide, &exit])
+        .build()?;
+
+    let tray = app.tray_by_id("main").unwrap();
+    tray.set_menu(Some(menu))?;
+    tray.on_menu_event(handle_event);
+
+    // stash this so we can find it later to change the text
+    app.manage(show_hide);
+
+    Ok(())
 }
 
 
-pub fn handle_event(app: &AppHandle, event: SystemTrayEvent) {
-    match event {
-        SystemTrayEvent::MenuItemClick{ id, .. } => {
-            match id.as_str() {
-                "exit" => app.exit(0),
-                "show" => {
-                    let _ = app.get_window("main").map(|w| w.show());
-                }
-                _ => (),
-            }
-        }
+fn handle_event(app_handle: &AppHandle, event: MenuEvent) {
+    match event.id.0.as_str() {
+        "exit" => app_handle.exit(0),
+        "show_hide" => {
+            let _ = app::toggle_main_window(app_handle);
+            let new_handle = app_handle.clone();
+            rt::spawn(async move {
+                let state = new_handle.state::<AppState>();
+                state.signal_activity().await;
+            });
+        },
         _ => (),
     }
 }

src-tauri/tauri.conf.json

@@ -3,64 +3,57 @@
   "build": {
     "beforeBuildCommand": "npm run build",
     "beforeDevCommand": "npm run dev",
-    "devPath": "http://localhost:5173",
-    "distDir": "../dist"
+    "frontendDist": "../dist",
+    "devUrl": "http://localhost:5173"
   },
-  "package": {
-    "productName": "creddy",
-    "version": "0.3.3"
-  },
-  "tauri": {
-    "allowlist": {
-      "os": {"all": true},
-      "dialog": {"open": true}
+  "bundle": {
+    "active": true,
+    "category": "DeveloperTool",
+    "copyright": "",
+    "targets": "all",
+    "externalBin": [],
+    "icon": [
+      "icons/32x32.png",
+      "icons/128x128.png",
+      "icons/128x128@2x.png",
+      "icons/icon.icns",
+      "icons/icon.ico"
+    ],
+    "windows": {
+      "certificateThumbprint": null,
+      "digestAlgorithm": "sha256",
+      "timestampUrl": "",
+      "wix": {
+        "fragmentPaths": [
+          "conf/cli.wxs"
+        ],
+        "componentRefs": [
+          "CliBinary",
+          "AddToPath"
+        ]
+      }
     },
-    "bundle": {
-      "active": true,
-      "category": "DeveloperTool",
-      "copyright": "",
+    "longDescription": "",
+    "macOS": {
+      "entitlements": null,
+      "exceptionDomain": "",
+      "frameworks": [],
+      "providerShortName": null,
+      "signingIdentity": null
+    },
+    "resources": [],
+    "shortDescription": "",
+    "linux": {
       "deb": {
         "depends": []
-      },
-      "externalBin": [],
-      "icon": [
-        "icons/32x32.png",
-        "icons/128x128.png",
-        "icons/128x128@2x.png",
-        "icons/icon.icns",
-        "icons/icon.ico"
-      ],
-      "identifier": "creddy",
-      "longDescription": "",
-      "macOS": {
-        "entitlements": null,
-        "exceptionDomain": "",
-        "frameworks": [],
-        "providerShortName": null,
-        "signingIdentity": null
-      },
-      "resources": [],
-      "shortDescription": "",
-      "targets": "all",
-      "windows": {
-        "certificateThumbprint": null,
-        "digestAlgorithm": "sha256",
-        "timestampUrl": "",
-        "wix": {
-          "fragmentPaths": ["conf/cli.wxs"],
-          "componentRefs": ["CliBinary", "AddToPath"]
-        }
       }
-    },
-    "security": {
-      "csp": {
-        "default-src": ["'self'"],
-        "style-src": ["'self'", "'unsafe-inline'"]
-      }
-    },
-    "updater": {
-      "active": false
-    },
+    }
+  },
+  "productName": "creddy",
+  "version": "0.4.9",
+  "identifier": "creddy",
+  "plugins": {},
+  "app": {
     "windows": [
       {
         "fullscreen": false,
@@ -72,9 +65,24 @@
         "visible": false
       }
     ],
-    "systemTray": {
+    "trayIcon": {
+      "id": "main",
       "iconPath": "icons/icon.png",
       "iconAsTemplate": true
+    },
+    "security": {
+      "csp": {
+        "style-src": [
+          "'self'",
+          "'unsafe-inline'"
+        ],
+        "default-src": [
+          "'self'"
+        ],
+        "connect-src": [
+          "ipc: http://ipc.localhost"
+        ]
+      }
     }
   }
 }

src/App.svelte

@@ -1,42 +1,72 @@
 <script>
 import { onMount } from 'svelte';
 import { listen } from '@tauri-apps/api/event';
-import { invoke } from '@tauri-apps/api/tauri';
+import { invoke } from '@tauri-apps/api/core';
+import { getVersion } from '@tauri-apps/api/app';
 
-import { appState, acceptRequest } from './lib/state.js';
+import { appState, acceptRequest, cleanupRequest } from './lib/state.js';
 import { views, currentView, navigate } from './lib/routing.js';
 
+import Approve from './views/Approve.svelte';
+import CreatePassphrase from './views/CreatePassphrase.svelte';
+import Unlock from './views/Unlock.svelte';
 
-$views = import.meta.glob('./views/*.svelte', {eager: true});
-navigate('Home');
-
+// set up app state
 invoke('get_config').then(config => $appState.config = config);
-
-listen('credentials-request', (tauriEvent) => {
-    $appState.pendingRequests.put(tauriEvent.payload);
-});
-
-listen('launch-terminal-request', async (tauriEvent) => {
-    if ($appState.currentRequest === null) {
-        let status = await invoke('get_session_status');
-        if (status === 'locked') {
-            navigate('Unlock');
-        }
-        else if (status === 'empty') {
-            navigate('EnterCredentials');
-        }
-        // else, session is unlocked, so do nothing
-        // (although we shouldn't even get the event in that case)
-    }
-});
-
+invoke('get_session_status').then(status => $appState.sessionStatus = status);
+getVersion().then(version => $appState.appVersion = version);
 invoke('get_setup_errors')
     .then(errs => {
         $appState.setupErrors = errs.map(e => ({msg: e, show: true}));
     });
 
+
+// set up event handlers
+listen('credential-request', (tauriEvent) => {
+    $appState.pendingRequests.put(tauriEvent.payload);
+});
+
+listen('request-cancelled', (tauriEvent) => {
+    const id = tauriEvent.payload;
+    if (id === $appState.currentRequest?.id) {
+        cleanupRequest();
+    }
+    else {
+        const found = $appState.pendingRequests.find_remove(r => r.id === id);
+    }
+});
+
+listen('locked', () => {
+    $appState.sessionStatus = 'locked';
+});
+
+
+// set up navigation
+$views = import.meta.glob('./views/*.svelte', {eager: true});
+navigate('Home');
+
+
+// ready to rock and roll
 acceptRequest();
 </script>
 
 
-<svelte:component this="{$currentView}" />
+<svelte:window 
+    on:click={() => invoke('signal_activity')}
+    on:keydown={() => invoke('signal_activity')}
+/>
+
+
+{#if $appState.sessionStatus === 'empty'}
+    <!-- Empty state (no passphrase) takes precedence over everything -->
+    <CreatePassphrase />
+{:else if $appState.currentRequest !== null}
+    <!-- if a request is pending, show approval flow (will include unlock if necessary) -->
+    <Approve />
+{:else if $appState.sessionStatus === 'locked'}
+    <!-- if session is locked and no request is pending, show unlock screen -->
+    <Unlock />
+{:else}
+    <!-- normal operation -->
+    <svelte:component this="{$currentView}" />
+{/if}

src/lib/queue.js

@@ -30,5 +30,15 @@ export default function() {
             
             return this.items.shift();
         },
+
+        find_remove(pred) {
+            for (let i=0; i<this.items.length; i++) {
+                if (pred(this.items[i])) {
+                    this.items.splice(i, 1);
+                    return true;
+                }
+            }
+            return false;
+        },
     }
 }

src/lib/state.js

@@ -7,8 +7,9 @@ import { navigate, currentView, previousView } from './routing.js';
 export let appState = writable({
     currentRequest: null,
     pendingRequests: queue(),
-    credentialStatus: 'locked',
+    sessionStatus: 'locked',
     setupErrors: [],
+    appVersion: '',
 });
 
 
@@ -23,12 +24,12 @@ export async function acceptRequest() {
 }
 
 
-export function completeRequest() {
+export function cleanupRequest() {
+    currentView.set(get(previousView));
+    previousView.set(null);
     appState.update($appState => {
         $appState.currentRequest = null;
         return $appState;
     });
-    currentView.set(get(previousView));
-    previousView.set(null);
     acceptRequest();
 }

src/style.css

@@ -5,3 +5,8 @@
 .btn-alert-error {
     @apply bg-transparent hover:bg-[#cd5a5a] border border-error-content text-error-content
 }
+
+/* I like alert icons to be top-aligned */
+.alert > :where(*) {
+    align-items: flex-start;
+}

src/ui/ErrorAlert.svelte

@@ -7,11 +7,34 @@
     export let slideDuration = 150;
     let animationClass = "";
 
-    export function shake() {
+    let error = null;
+
+    function shake() {
         animationClass = 'shake';
         window.setTimeout(() => animationClass = "", 400);
     }
 
+    export async function run(fallible) {
+        try {
+            const ret = await Promise.resolve(fallible());
+            error = null;
+            return ret;
+        }
+        catch (e) {
+            if (error) shake();
+            error = e;
+            // re-throw so it can be caught by the caller if necessary
+            throw e;
+        }
+    }
+
+    // this is a method rather than a prop so that we can re-shake every time
+    // the error occurs, even if the error message doesn't change
+    export function setError(e) {
+        if (error) shake();
+        error = e;
+    }
+
 </script>
 
 
@@ -51,17 +74,17 @@
 </style>
 
 
-<div in:slide="{{duration: slideDuration}}" class="alert alert-error shadow-lg {animationClass} {extraClasses}">
-    <div>
+{#if error}
+    <div transition:slide="{{duration: slideDuration}}" class="alert alert-error shadow-lg {animationClass} {extraClasses}">
         <svg xmlns="http://www.w3.org/2000/svg" class="stroke-current flex-shrink-0 h-6 w-6" fill="none" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 14l2-2m0 0l2-2m-2 2l-2-2m2 2l2 2m7-2a9 9 0 11-18 0 9 9 0 0118 0z" /></svg>
         <span>
-            <slot></slot>
+            <slot {error}>{error.msg || error}</slot>
         </span>
-    </div>
 
-    {#if $$slots.buttons}
-        <div>
-            <slot name="buttons"></slot>
-        </div>
-    {/if}
-</div>
+        {#if $$slots.buttons}
+            <div>
+                <slot name="buttons"></slot>
+            </div>
+        {/if}
+    </div>
+{/if}

src/ui/Icon.svelte

@@ -5,7 +5,7 @@
     let classes = "";
     export {classes as class};
 
-    let svg = ICONS[`./icons/${name}.svelte`].default;
+    $: svg = ICONS[`./icons/${name}.svelte`].default;
 </script>
 
 <svelte:component this={svg} class={classes} />

src/ui/KeyCombo.svelte

@@ -1,13 +1,15 @@
 <script>
     export let keys;
+    let classes = '';
+    export {classes as class};
 </script>
 
 
-<div class="flex gap-x-[0.2em] items-center">
+<span class="inline-flex gap-x-[0.2em] items-center {classes}">
     {#each keys as key, i}
         {#if i > 0}
             <span class="mt-[-0.1em]">+</span>
         {/if}
         <kbd class="normal-case px-1 py-0.5 rounded border border-neutral">{key}</kbd>
     {/each}
-</div>
+</span>

src/ui/Link.svelte

@@ -21,16 +21,17 @@
             throw(`Link target is not a string or a function: ${target}`)
         }
     }
-
+        
 
     function handleHotkey(event) {
-        if (!hotkey) return;
-        if (ctrl && !event.ctrlKey) return;
-        if (alt && !event.altKey) return;
-        if (shift && !event.shiftKey) return;
-
-        if (event.key === hotkey) {
+        if (
+            hotkey === event.key
+            && ctrl === event.ctrlKey
+            && alt === event.altKey
+            && shift === event.shiftKey
+        ) {
             click();
+            event.preventDefault();
         }
     }
 </script>

src/ui/PassphraseInput.svelte

@@ -0,0 +1,46 @@
+<script>
+    import Icon from './Icon.svelte';
+
+    export let value = '';
+    export let placeholder = '';
+    export let autofocus = false;
+    let classes = '';
+    export {classes as class};
+
+    let show = false;
+</script>
+
+
+<style>
+    button {
+        border: 1px solid oklch(var(--bc) / 0.2);
+        border-left: none;
+    }
+</style>
+
+
+<div class="join w-full">
+    <input
+        type={show ? 'text' : 'password'}
+        {value} {placeholder} {autofocus}
+        on:input={e => value = e.target.value}
+        on:input on:change on:focus on:blur
+        class="input input-bordered flex-grow join-item placeholder:text-gray-500 {classes}"
+    />
+
+    <button
+        type="button"
+        class="btn btn-ghost join-item swap swap-rotate"
+        class:swap-active={show}
+        on:click={() => show = !show}
+    >
+        <Icon
+            name="eye"
+            class="w-5 h-5 swap-off"
+        />
+        <Icon
+            name="eye-slash"
+            class="w-5 h-5 swap-on"
+        />
+    </button>
+</div>

src/ui/icons/arrow-right-start-on-rectangle.svelte

@@ -0,0 +1,8 @@
+<script>
+  let classes = '';
+  export {classes as class}
+</script>
+
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class={classes}>
+  <path stroke-linecap="round" stroke-linejoin="round" d="M15.75 9V5.25A2.25 2.25 0 0 0 13.5 3h-6a2.25 2.25 0 0 0-2.25 2.25v13.5A2.25 2.25 0 0 0 7.5 21h6a2.25 2.25 0 0 0 2.25-2.25V15m3 0 3-3m0 0-3-3m3 3H9" />
+</svg>

src/ui/icons/command-line.svelte

@@ -0,0 +1,8 @@
+<script>
+  let classes = '';
+  export {classes as class}
+</script>
+
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class={classes}>
+  <path stroke-linecap="round" stroke-linejoin="round" d="m6.75 7.5 3 2.25-3 2.25m4.5 0h3m-9 8.25h13.5A2.25 2.25 0 0 0 21 18V6a2.25 2.25 0 0 0-2.25-2.25H5.25A2.25 2.25 0 0 0 3 6v12a2.25 2.25 0 0 0 2.25 2.25Z" />
+</svg>

src/ui/icons/eye-slash.svelte

@@ -0,0 +1,9 @@
+<script>
+    let classes = "";
+    export {classes as class};
+</script>
+
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class={classes}>
+  <path stroke-linecap="round" stroke-linejoin="round" d="M3.98 8.223A10.477 10.477 0 0 0 1.934 12C3.226 16.338 7.244 19.5 12 19.5c.993 0 1.953-.138 2.863-.395M6.228 6.228A10.451 10.451 0 0 1 12 4.5c4.756 0 8.773 3.162 10.065 7.498a10.522 10.522 0 0 1-4.293 5.774M6.228 6.228 3 3m3.228 3.228 3.65 3.65m7.894 7.894L21 21m-3.228-3.228-3.65-3.65m0 0a3 3 0 1 0-4.243-4.243m4.242 4.242L9.88 9.88" />
+</svg>
+

src/ui/icons/eye.svelte

@@ -0,0 +1,9 @@
+<script>
+    let classes = "";
+    export {classes as class};
+</script>
+
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class={classes}>
+  <path stroke-linecap="round" stroke-linejoin="round" d="M2.036 12.322a1.012 1.012 0 0 1 0-.639C3.423 7.51 7.36 4.5 12 4.5c4.638 0 8.573 3.007 9.963 7.178.07.207.07.431 0 .639C20.577 16.49 16.64 19.5 12 19.5c-4.638 0-8.573-3.007-9.963-7.178Z" />
+  <path stroke-linecap="round" stroke-linejoin="round" d="M15 12a3 3 0 1 1-6 0 3 3 0 0 1 6 0Z" />
+</svg>

src/ui/icons/key.svelte

@@ -0,0 +1,8 @@
+<script>
+  let classes = '';
+  export {classes as class}
+</script>
+
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class={classes}>
+  <path stroke-linecap="round" stroke-linejoin="round" d="M15.75 5.25a3 3 0 0 1 3 3m3 0a6 6 0 0 1-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1 1 21.75 8.25Z" />
+</svg>

src/ui/icons/pencil.svelte

@@ -0,0 +1,8 @@
+<script>
+    let classes = '';
+    export {classes as class};
+</script>
+
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class={classes}>
+  <path stroke-linecap="round" stroke-linejoin="round" d="m16.862 4.487 1.687-1.688a1.875 1.875 0 1 1 2.652 2.652L6.832 19.82a4.5 4.5 0 0 1-1.897 1.13l-2.685.8.8-2.685a4.5 4.5 0 0 1 1.13-1.897L16.863 4.487Zm0 0L19.5 7.125" />
+</svg>

src/ui/icons/plus-circle-mini.svelte

@@ -0,0 +1,9 @@
+<script>
+  let classes = "";
+  export {classes as class};
+</script>
+
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" fill="currentColor" class={classes}>
+  <path fill-rule="evenodd" d="M10 18a8 8 0 1 0 0-16 8 8 0 0 0 0 16Zm.75-11.25a.75.75 0 0 0-1.5 0v2.5h-2.5a.75.75 0 0 0 0 1.5h2.5v2.5a.75.75 0 0 0 1.5 0v-2.5h2.5a.75.75 0 0 0 0-1.5h-2.5v-2.5Z" clip-rule="evenodd" />
+</svg>
+

src/ui/icons/shield-check.svelte

@@ -0,0 +1,8 @@
+<script>
+  let classes = '';
+  export {classes as class}
+</script>
+
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class={classes}>
+  <path stroke-linecap="round" stroke-linejoin="round" d="M9 12.75 11.25 15 15 9.75m-3-7.036A11.959 11.959 0 0 1 3.598 6 11.99 11.99 0 0 0 3 9.749c0 5.592 3.824 10.29 9 11.623 5.176-1.332 9-6.03 9-11.622 0-1.31-.21-2.571-.598-3.751h-.152c-3.196 0-6.1-1.248-8.25-3.285Z" />
+</svg>

src/ui/icons/trash.svelte

@@ -0,0 +1,8 @@
+<script>
+    let classes = '';
+    export {classes as class};
+</script>
+
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class={classes}>
+  <path stroke-linecap="round" stroke-linejoin="round" d="m14.74 9-.346 9m-4.788 0L9.26 9m9.968-3.21c.342.052.682.107 1.022.166m-1.022-.165L18.16 19.673a2.25 2.25 0 0 1-2.244 2.077H8.084a2.25 2.25 0 0 1-2.244-2.077L4.772 5.79m14.456 0a48.108 48.108 0 0 0-3.478-.397m-12 .562c.34-.059.68-.114 1.022-.165m0 0a48.11 48.11 0 0 1 3.478-.397m7.5 0v-.916c0-1.18-.91-2.164-2.09-2.201a51.964 51.964 0 0 0-3.32 0c-1.18.037-2.09 1.022-2.09 2.201v.916m7.5 0a48.667 48.667 0 0 0-7.5 0" />
+</svg>

src/ui/settings/FileSetting.svelte

@@ -1,6 +1,6 @@
 <script>
     import { createEventDispatcher } from 'svelte';
-    import { open } from '@tauri-apps/api/dialog';
+    import { open } from '@tauri-apps/plugin-dialog';
     import Setting from './Setting.svelte';
 
     export let title;

src/ui/settings/NumericSetting.svelte

@@ -10,15 +10,21 @@
     export let min = null;
     export let max = null;
     export let decimal = false;
+    export let debounceInterval = 0;
 
     const dispatch = createEventDispatcher();
 
     $: localValue = value.toString();
     let lastInputTime = null;
     function debounce(event) {
-        lastInputTime = Date.now();
         localValue = localValue.replace(/[^-0-9.]/g, '');
 
+        if (debounceInterval === 0) {
+            updateValue(localValue);
+            return;
+        }
+
+        lastInputTime = Date.now();
         const eventTime = lastInputTime;
         const pendingValue = localValue;
         window.setTimeout(
@@ -28,7 +34,7 @@
                     updateValue(pendingValue);
                 }
             },
-            500
+            debounceInterval,
         )
     }
 

src/ui/settings/Setting.svelte

@@ -1,13 +1,12 @@
 <script>
     import { slide } from 'svelte/transition';
-    import ErrorAlert from '../ErrorAlert.svelte';
 
     export let title;
 </script>
 
 
 <div>
-    <div class="flex flex-wrap justify-between gap-y-4">
+    <div class="flex flex-wrap justify-between gap-4">
         <h3 class="text-lg font-bold shrink-0">{title}</h3>
         {#if $$slots.input}
             <slot name="input"></slot>

src/ui/settings/TimeSetting.svelte

@@ -0,0 +1,92 @@
+<script>
+    import Setting from './Setting.svelte';
+
+    import { createEventDispatcher } from 'svelte';
+    const dispatch = createEventDispatcher();
+
+
+    export let title;
+    // seconds are required
+    export let seconds;
+
+    export let min = 0;
+    export let max = null;
+
+    // best unit is the unit that results in the smallest non-fractional number
+    let unit = null;
+
+    const UNITS = {
+        Seconds: 1,
+        Minutes: 60,
+        Hours: 3600,
+        Days: 86400,
+    };
+
+    if (unit === null) {
+        let min = Infinity;
+        let bestUnit = null;
+        for (const [u, multiplier] of Object.entries(UNITS)) {
+            const v = seconds / multiplier;
+            if (v < min && v >= 1) {
+                min = v;
+                bestUnit = u;
+            }
+        }
+        unit = bestUnit;
+    }
+
+
+    // local value is only one-way synced to value so that we can better handle changes
+    $: localValue = (seconds / UNITS[unit]).toString();
+    let error = null;
+
+    function updateValue() {
+        localValue = localValue.replace(/[^0-9.]/g, '');
+        // Don't update the value, but also don't error, if it's empty,
+        // or if it could be the start of a float
+        if (localValue === '' || localValue === '.') {
+            error = null;
+            return;
+        }
+
+        const num = parseFloat(localValue);
+        if (num < 0) {
+            error = `${num} is not a valid duration`
+        }
+        else if (min !== null && num < min) {
+            error = `Too low (minimum ${min * UNITS[unit]}`;
+        }
+        else if (max !== null & num > max) {
+            error = `Too high (maximum ${max * UNITS[unit]}`;
+        }
+        else {
+            error = null;
+            seconds = Math.round(num * UNITS[unit]);
+            dispatch('update', {seconds});
+        }
+    }
+</script> 
+
+
+<Setting {title}>
+    <div slot="input">
+        <select class="select select-bordered select-sm mr-2" bind:value={unit}>
+            {#each Object.keys(UNITS) as u}
+                <option selected={u === unit || null}>{u}</option>
+            {/each}
+        </select>
+
+        <div class="tooltip tooltip-error" class:tooltip-open={error !== null} data-tip={error}>
+            <input
+                type="text"
+                class="input input-sm input-bordered text-right"
+                size={Math.max(5, localValue.length)}
+                class:input-error={error}
+                bind:value={localValue}
+                on:input={updateValue}
+            >
+        </div>
+    </div>
+
+    <slot name="description" slot="description"></slot>
+</Setting>

src/ui/settings/index.js

@@ -3,3 +3,4 @@ export { default as ToggleSetting } from './ToggleSetting.svelte';
 export { default as NumericSetting } from './NumericSetting.svelte';
 export { default as FileSetting } from './FileSetting.svelte';
 export { default as TextSetting } from './TextSetting.svelte';
+export { default as TimeSetting } from './TimeSetting.svelte';

src/views/Approve.svelte

@@ -1,120 +1,64 @@
 <script>
-    import { onMount } from 'svelte';
-    import { invoke } from '@tauri-apps/api/tauri';
+    import { appState, cleanupRequest } from '../lib/state.js';
+    import { invoke } from '@tauri-apps/api/core';
 
-    import { navigate } from '../lib/routing.js';
-    import { appState, completeRequest } from '../lib/state.js';
     import ErrorAlert from '../ui/ErrorAlert.svelte';
-    import Link from '../ui/Link.svelte';
-    import KeyCombo from '../ui/KeyCombo.svelte';
+    import CollectResponse from './approve/CollectResponse.svelte';
+    import ShowResponse from './approve/ShowResponse.svelte';
+    import Unlock from './Unlock.svelte';
 
 
-    // Send response to backend, display error if applicable
-    let error, alert;
-    async function respond() {
-        let {id, approval} = $appState.currentRequest;
+    // Extra 50ms so the window can finish disappearing before the redraw
+    const rehideDelay = Math.min(5000, $appState.config.rehide_ms + 50);
+
+    let alert;
+    let success = false;
+    async function sendResponse() {
         try {
-            await invoke('respond', {response: {id, approval}});
-            navigate('ShowResponse');
+            await invoke('respond', {response: $appState.currentRequest.response});
+            success = true;
+            window.setTimeout(cleanupRequest, rehideDelay);
         }
         catch (e) {
-            if (error) {
-                alert.shake();
-            }
-            error = e;
+            // reset to null so that we go back to asking for approval
+            $appState.currentRequest.response = null;
+            // setTimeout forces this to not happen until the alert has been rendered
+            window.setTimeout(() => alert.setError(e), 0);
         }
     }
 
-    // Approval has one of several outcomes depending on current credential state
-    async function approve() {
-        $appState.currentRequest.approval = 'Approved';
-        let status = await invoke('get_session_status');
-        if (status === 'unlocked') {
-            await respond();
-        }
-        else if (status === 'locked') {
-            navigate('Unlock');
-        }
-        else {
-            navigate('EnterCredentials');
+    async function handleResponseCollected() {
+        if (
+            $appState.sessionStatus === 'unlocked'
+            || $appState.currentRequest.response.approval === 'Denied'
+        ) {
+            await sendResponse();
         }
     }
-
-    // Denial has only one
-    async function deny() {
-        $appState.currentRequest.approval = 'Denied';
-        await respond();
-    }
-
-    // Extract executable name from full path
-    const client = $appState.currentRequest.client;
-    const m = client.exe?.match(/\/([^/]+?$)|\\([^\\]+?$)/);
-    const appName = m[1] || m[2];
-
-    // Executable paths can be long, so ensure they only break on \ or /
-    function breakPath(path) {
-        return path.replace(/(\\|\/)/g, '$1<wbr>');
-    }
-
-    // if the request has already been approved/denied, send response immediately
-    onMount(async () => {
-        if ($appState.currentRequest.approval) {
-            await respond();
-        }
-    })
 </script>
 
 
-<!-- Don't render at all if we're just going to immediately proceed to the next screen -->
-{#if error || !$appState.currentRequest.approval}
+{#if success}
+    <!-- if we have successfully sent a response, show it -->
+    <ShowResponse />
+{:else if !$appState.currentRequest?.response}
+    <!-- if a response hasn't been collected, ask for it -->
     <div class="flex flex-col space-y-4 p-4 m-auto max-w-xl h-screen items-center justify-center">
-        {#if error}
-            <ErrorAlert bind:this={alert}>
-                {error}
-                <svelte:fragment slot="buttons">
-                    <button class="btn btn-sm btn-alert-error" on:click={completeRequest}>Cancel</button>
-                    <button class="btn btn-sm btn-alert-error" on:click={respond}>Retry</button>
-                </svelte:fragment>
-            </ErrorAlert>
-        {/if}
+        <ErrorAlert bind:this={alert}>
+            <svelte:fragment slot="buttons">
+                <button class="btn btn-sm btn-alert-error" on:click={cleanupRequest}>Cancel</button>
+                <button class="btn btn-sm btn-alert-error" on:click={sendResponse}>Retry</button>
+            </svelte:fragment>
+        </ErrorAlert>
 
-        {#if $appState.currentRequest.base}
-            <div class="alert alert-warning shadow-lg">
-                <div>
-                    <svg xmlns="http://www.w3.org/2000/svg" class="stroke-current flex-shrink-0 h-6 w-6" fill="none" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" /></svg>
-                    <span>
-                        WARNING: This application is requesting your base (long-lived) AWS credentials. 
-                        These credentials are less secure than session credentials, since they don't expire automatically.
-                    </span>
-                </div>
-            </div>
-        {/if}
-
-        <div class="space-y-1 mb-4">
-            <h2 class="text-xl font-bold">{appName ? `"${appName}"` : 'An appplication'} would like to access your AWS credentials.</h2>
-
-            <div class="grid grid-cols-[auto_1fr] gap-x-3">
-                <div class="text-right">Path:</div>
-                <code class="">{@html client.exe ? breakPath(client.exe) : 'Unknown'}</code>
-                <div class="text-right">PID:</div>
-                <code>{client.pid}</code>
-            </div>
-        </div>
-
-        <div class="w-full flex justify-between">
-            <Link target={deny} hotkey="Escape">
-                <button class="btn btn-error justify-self-start">
-                    <span class="mr-2">Deny</span>
-                    <KeyCombo keys={['Esc']} />
-                </button>
-            </Link>
-
-            <Link target={approve} hotkey="Enter" shift="{true}">
-                <button class="btn btn-success justify-self-end">
-                    <span class="mr-2">Approve</span>
-                    <KeyCombo keys={['Shift', 'Enter']} />
-                </button>
-            </Link>
-        </div>
+        <CollectResponse  on:response={handleResponseCollected} />
     </div>
-{/if}
+{:else if $appState.sessionStatus === 'locked'}
+    <!-- if session is locked and we do have a response, we must be waiting for unlock -->
+    <Unlock on:unlocked={sendResponse} />
+{:else}
+    <!-- failsafe sanity check -->
+    <ErrorAlert>
+        Something is wrong. This message should never show up during normal operation.
+    </ErrorAlert>
+{/if}

src/views/ChangePassphrase.svelte

@@ -0,0 +1,14 @@
+<script>
+    import { navigate } from '../lib/routing.js';
+
+    import EnterPassphrase from './passphrase/EnterPassphrase.svelte';
+</script>
+
+
+<div class="flex flex-col h-screen max-w-sm m-auto gap-y-8 justify-center">
+        <h1 class="text-2xl font-bold text-center">
+            Change passphrase
+        </h1>
+
+        <EnterPassphrase cancellable={true} on:save={() => navigate('Home')}/>
+</div>

src/views/CreatePassphrase.svelte

@@ -0,0 +1,21 @@
+<script>
+    import EnterPassphrase from './passphrase/EnterPassphrase.svelte';
+</script>
+
+
+<div class="flex flex-col h-screen max-w-lg m-auto justify-center">
+    <div class="space-y-8">
+        <h1 class="text-2xl font-bold text-center">Welcome to Creddy!</h1>
+
+        <div class="space-y-4">
+            <p> Create a passphrase to get started.</p>
+
+            <p>Please note that if you forget your passphrase, there is no way to recover 
+            your stored credentials. You will have to start over with a new passphrase.</p>
+        </div>
+
+        <div class="max-w-sm mx-auto">
+            <EnterPassphrase />
+        </div>
+    </div>
+</div>

src/views/EnterCredentials.svelte

@@ -1,91 +0,0 @@
-<script>
-    import { onMount } from 'svelte';
-    import { invoke } from '@tauri-apps/api/tauri';
-    import { getRootCause } from '../lib/errors.js';
-
-    import { appState } from '../lib/state.js';
-    import { navigate } from '../lib/routing.js';
-    import Link from '../ui/Link.svelte';
-    import ErrorAlert from '../ui/ErrorAlert.svelte';
-    import Spinner from '../ui/Spinner.svelte';
-
-
-    let errorMsg = null;
-    let alert;
-    let AccessKeyId, SecretAccessKey, passphrase, confirmPassphrase
-
-    function confirm() {
-        if (passphrase !== confirmPassphrase) {
-            errorMsg = 'Passphrases do not match.'
-        }
-    }
-
-    let saving = false;
-    async function save() {
-        if (passphrase !== confirmPassphrase) {
-            alert.shake();
-            return;
-        }
-
-        let credentials = {AccessKeyId, SecretAccessKey};
-        try {
-            saving = true;
-            await invoke('save_credentials', {credentials, passphrase});
-            emit('credentials-event', 'entered');
-            if ($appState.currentRequest) {
-                navigate('Approve');
-            }
-            else {
-                navigate('Home');
-            }
-        }
-        catch (e) {
-            window.error = e;
-            const root = getRootCause(e);
-            if (e.code === 'GetSession' && root.code) {
-                errorMsg = `Error response from AWS (${root.code}): ${root.msg}`;
-            }
-            else {
-                errorMsg = e.msg;
-            }
-
-            // if the alert already existed, shake it
-            if (alert) {
-                alert.shake();
-            }
-
-            saving = false;
-        }
-    }
-
-    function cancel() {
-        emit('credentials-event', 'enter-canceled');
-        navigate('Home');
-    }
-</script>
-
-
-
-<form action="#" on:submit|preventDefault="{save}" class="form-control space-y-4 max-w-sm m-auto p-4 h-screen justify-center">
-    <h2 class="text-2xl font-bold text-center">Enter your credentials</h2>
-
-    {#if errorMsg}
-        <ErrorAlert bind:this="{alert}">{errorMsg}</ErrorAlert>
-    {/if}
-
-    <input type="text" placeholder="AWS Access Key ID" bind:value="{AccessKeyId}" class="input input-bordered" />
-    <input type="password" placeholder="AWS Secret Access Key" bind:value="{SecretAccessKey}" class="input input-bordered" />
-    <input type="password" placeholder="Passphrase" bind:value="{passphrase}" class="input input-bordered" />
-    <input type="password" placeholder="Re-enter passphrase" bind:value={confirmPassphrase} class="input input-bordered" on:change={confirm} />
-
-    <button type="submit" class="btn btn-primary">
-        {#if saving }
-            <Spinner class="w-5 h-5" thickness="12"/>
-        {:else}
-            Submit
-        {/if}
-    </button>
-    <Link target={cancel} hotkey="Escape">
-        <button class="btn btn-sm btn-outline w-full">Cancel</button>
-    </Link>
-</form>

src/views/Home.svelte

@@ -1,6 +1,6 @@
 <script>
     import { onMount } from 'svelte';
-    import { invoke } from '@tauri-apps/api/tauri';
+    import { invoke } from '@tauri-apps/api/core';
 
     import { appState } from '../lib/state.js';
     import { navigate } from '../lib/routing.js';
@@ -8,13 +8,21 @@
     import Icon from '../ui/Icon.svelte';
     import Link from '../ui/Link.svelte';
 
-    import vaultDoorSvg from '../assets/vault_door.svg?raw';
 
     let launchBase = false;
     function launchTerminal() {
         invoke('launch_terminal', {base: launchBase});
         launchBase = false;
     }
+
+    async function lock() {
+        try {
+            await invoke('lock');
+        }
+        catch (e) {
+            console.log(e);
+        }
+    }
 </script>
 
 
@@ -23,33 +31,38 @@
 </Nav>
 
 <div class="flex flex-col h-screen items-center justify-center p-4 space-y-4">
-    <div class="flex flex-col items-center space-y-4">
-        {@html vaultDoorSvg}
-        {#await invoke('get_session_status') then status}
-            {#if status === 'locked'}
+    <div class="grid grid-cols-2 gap-6">
+        <Link target="ManageCredentials">
+            <div class="flex flex-col items-center gap-4 h-full max-w-56 rounded-box p-4 border border-primary hover:bg-base-200 transition-colors">
+                <Icon name="key" class="size-12 stroke-1 stroke-primary" />
+                <h3 class="text-lg font-bold">Credentials</h3>
+                <p class="text-sm">Add, remove, and change defaults credentials.</p>
+            </div>
+        </Link>
+        
+        <Link target={launchTerminal}>
+            <div class="flex flex-col items-center gap-4 h-full max-w-56 rounded-box p-4 border border-secondary hover:bg-base-200 transition-colors">
+                <Icon name="command-line" class="size-12 stroke-1 stroke-secondary" />
+                <h3 class="text-lg font-bold">Terminal</h3>
+                <p class="text-sm">Launch a terminal pre-configured with AWS credentials.</p>
+            </div>
+        </Link>
 
-                <h2 class="text-2xl font-bold">Creddy is locked</h2>
-                <Link target="Unlock" hotkey="Enter" class="w-64">
-                    <button class="btn btn-primary w-full">Unlock</button>
-                </Link>
+        <Link target={lock}>
+            <div class="flex flex-col items-center gap-4 h-full max-w-56 rounded-box p-4 border border-accent hover:bg-base-200 transition-colors">
+                <Icon name="shield-check" class="size-12 stroke-1 stroke-accent" />
+                <h3 class="text-lg font-bold">Lock</h3>
+                <p class="text-sm">Lock Creddy.</p>
+            </div>
+        </Link>
 
-            {:else if status === 'unlocked'}
-                <h2 class="text-2xl font-bold">Waiting for requests</h2>
-                <button class="btn btn-primary w-full" on:click={launchTerminal}>
-                    Launch Terminal
-                </button>
-                <label class="label cursor-pointer flex items-center space-x-2">
-                    <input type="checkbox" class="checkbox checkbox-sm" bind:checked={launchBase}>
-                    <span class="label-text">Launch with base credentials</span>
-                </label>
-
-            {:else if status === 'empty'}
-                <h2 class="text-2xl font-bold">No credentials found</h2>
-                <Link target="EnterCredentials" hotkey="Enter" class="w-64">
-                    <button class="btn btn-primary w-full">Enter Credentials</button>
-                </Link>
-            {/if}
-        {/await}
+        <Link target={() => invoke('exit')}>
+            <div class="flex flex-col items-center gap-4 h-full max-w-56 rounded-box p-4 border border-warning hover:bg-base-200 transition-colors">
+                <Icon name="arrow-right-start-on-rectangle" class="size-12 stroke-1 stroke-warning" />
+                <h3 class="text-lg font-bold">Exit</h3>
+                <p class="text-sm">Close Creddy.</p>
+            </div>
+        </Link>
     </div>
 </div>
 

src/views/ManageCredentials.svelte

@@ -0,0 +1,62 @@
+<script>
+    import { onMount } from 'svelte';
+    import { slide, fade } from 'svelte/transition';
+    import { writable } from 'svelte/store';
+    import { invoke } from '@tauri-apps/api/core';
+
+    import AwsCredential from './credentials/AwsCredential.svelte';
+    import Icon from '../ui/Icon.svelte';
+    import Nav from '../ui/Nav.svelte';
+
+    let show = false;
+
+    let records = []
+    let defaults = writable({});
+    async function loadCreds() {
+        records = await invoke('list_credentials');
+        let pairs = records.filter(r => r.is_default).map(r => [r.credential.type, r.id]);
+        $defaults = Object.fromEntries(pairs);
+    }
+    onMount(loadCreds);
+
+    function newAws() {
+        records.push({
+            id: crypto.randomUUID(),
+            name: null,
+            is_default: false,
+            credential: {type: 'AwsBase', AccessKeyId: null, SecretAccessKey: null},
+            isNew: true,
+        });
+        records = records;
+    }
+</script>
+
+
+<Nav>
+    <h1 slot="title" class="text-2xl font-bold">Credentials</h1>
+</Nav>
+
+<div class="max-w-xl mx-auto mb-12 flex flex-col gap-y-4 justify-center">
+    <div class="divider">
+        <h2 class="text-xl font-bold">AWS Access Keys</h2>
+    </div>
+
+    {#if records.length > 0}
+        {#each records as record (record.id)}
+            <AwsCredential {record} {defaults} on:update={loadCreds} />
+        {/each}
+        <button class="btn btn-primary btn-wide mx-auto" on:click={newAws}>
+            <Icon name="plus-circle-mini" class="size-5" />
+            Add
+        </button>
+    {:else}
+        <div class="flex flex-col gap-6 items-center rounded-box border-2 border-dashed border-neutral-content/30 p-6">
+            <div>You have no saved AWS credentials.</div>
+            <button class="btn btn-primary btn-wide mx-auto" on:click={newAws}>
+                <Icon name="plus-circle-mini" class="size-5" />
+                Add
+            </button>
+        </div>
+    {/if}
+
+</div>

src/views/Settings.svelte

@@ -1,28 +1,31 @@
 <script>
-    import { invoke } from '@tauri-apps/api/tauri';
-    import { type } from '@tauri-apps/api/os';
+    import { invoke } from '@tauri-apps/api/core';
+    import { type } from '@tauri-apps/plugin-os';
 
     import { appState } from '../lib/state.js';
     import Nav from '../ui/Nav.svelte';
     import Link from '../ui/Link.svelte';
-    import ErrorAlert from '../ui/ErrorAlert.svelte';
     import SettingsGroup from '../ui/settings/SettingsGroup.svelte';
     import Keybind from '../ui/settings/Keybind.svelte';
-    import { Setting, ToggleSetting, NumericSetting, FileSetting, TextSetting } from '../ui/settings';
+    import { Setting, ToggleSetting, NumericSetting, FileSetting, TextSetting, TimeSetting } from '../ui/settings';
 
     import { fly } from 'svelte/transition';
     import { backInOut } from 'svelte/easing';
 
 
+    // make an independent copy so it can differ from the main config object
+    let config = JSON.parse(JSON.stringify($appState.config));
+    $: configModified = JSON.stringify(config) !== JSON.stringify($appState.config);
+
     let error = null;
     async function save() {
-        console.log('updating config');
         try {
-            await invoke('save_config', {config: $appState.config});
+            throw('wtf');
+            await invoke('save_config', {config});
+            $appState.config = await invoke('get_config');
         }
         catch (e) {
             error = e;
-            $appState.config = await invoke('get_config');
         }
     }
 
@@ -35,22 +38,22 @@
     <h1 slot="title" class="text-2xl font-bold">Settings</h1>
 </Nav>
 
-{#await invoke('get_config') then config}
-    <div class="max-w-lg mx-auto mt-1.5 p-4 space-y-16">
+<form on:submit|preventDefault={save}>
+    <div class="max-w-lg mx-auto my-1.5 p-4 space-y-16">
         <SettingsGroup name="General">            
-            <ToggleSetting title="Start on login" bind:value={$appState.config.start_on_login} on:update={save}>
+            <ToggleSetting title="Start on login" bind:value={config.start_on_login}>
                 <svelte:fragment slot="description">
                     Start Creddy when you log in to your computer.
                 </svelte:fragment>
             </ToggleSetting>
 
-            <ToggleSetting title="Start minimized" bind:value={$appState.config.start_minimized} on:update={save}>
+            <ToggleSetting title="Start minimized" bind:value={config.start_minimized}>
                 <svelte:fragment slot="description">
                     Minimize to the system tray at startup.
                 </svelte:fragment>
             </ToggleSetting>
 
-            <NumericSetting title="Re-hide delay" bind:value={$appState.config.rehide_ms} min={0} unit="Milliseconds" on:update={save}>
+            <NumericSetting title="Re-hide delay" bind:value={config.rehide_ms} min={0} unit="Milliseconds">
                 <svelte:fragment slot="description">
                     How long to wait after a request is approved/denied before minimizing
                     the window to tray. Only applicable if the window was minimized
@@ -58,19 +61,32 @@
                 </svelte:fragment>
             </NumericSetting>
 
-            <Setting title="Update credentials">
-                <Link slot="input" target="EnterCredentials">
-                    <button class="btn btn-sm btn-primary">Update</button>
+            <ToggleSetting title="Lock when idle" bind:value={config.auto_lock}>
+                <svelte:fragment slot="description">
+                    Automatically lock Creddy after a period of inactivity.
+                </svelte:fragment>
+            </ToggleSetting>
+
+            {#if config.auto_lock}
+                <TimeSetting title="Idle timeout" bind:seconds={config.lock_after.secs}>
+                    <svelte:fragment slot="description">
+                        How long to wait before automatically locking.
+                    </svelte:fragment>
+                </TimeSetting>
+            {/if}
+
+            <Setting title="Update passphrase">
+                <Link slot="input" target="ChangePassphrase">
+                    <button type="button" class="btn btn-sm btn-primary">Update</button>
                 </Link>
                 <svelte:fragment slot="description">
-                    Update or re-enter your encrypted credentials.
+                    Change your master passphrase.
                 </svelte:fragment>
             </Setting>
 
             <FileSetting
                 title="Terminal emulator"
-                bind:value={$appState.config.terminal.exec}
-                on:update={save}
+                bind:value={config.terminal.exec}
             >
                 <svelte:fragment slot="description">
                     Choose your preferred terminal emulator (e.g. <code>gnome-terminal</code> or <code>wt.exe</code>.) May be an absolute path or an executable discoverable on <code>$PATH</code>.
@@ -83,14 +99,17 @@
                 <p>Click on a keybinding to modify it. Use the checkbox to enable or disable a keybinding entirely.</p>
 
                 <div class="grid grid-cols-[auto_1fr_auto] gap-y-3 items-center">
-                    <Keybind description="Show Creddy" value={$appState.config.hotkeys.show_window} on:update={save} />
-                    <Keybind description="Launch terminal" value={$appState.config.hotkeys.launch_terminal} on:update={save} />
+                    <Keybind description="Show Creddy" bind:value={config.hotkeys.show_window} />
+                    <Keybind description="Launch terminal" bind:value={config.hotkeys.launch_terminal} />
                 </div>
             </div>
         </SettingsGroup>
 
+        <p class="text-sm text-right">
+            Creddy {$appState.appVersion}
+        </p>
     </div>
-{/await}
+</form>
 
 {#if error}
     <div transition:fly={{y: 100, easing: backInOut, duration: 400}} class="toast">
@@ -104,4 +123,15 @@
             </div>
         </div>
     </div>
+{:else if configModified}
+    <div transition:fly={{y: 100, easing: backInOut, duration: 400}} class="toast">
+        <div class="alert shadow-lg no-animation">
+            <span>You have unsaved changes.</span>
+
+            <div>
+                <!-- <button class="btn btn-sm btn-ghost">Cancel</button> -->
+                <button class="btn btn-sm btn-primary" on:click={save}>Save</button>
+            </div>
+        </div>
+    </div>
 {/if}

src/views/Unlock.svelte

@@ -1,78 +1,59 @@
 <script>
-    import { invoke } from '@tauri-apps/api/tauri';
+    import { invoke } from '@tauri-apps/api/core';
     import { emit } from '@tauri-apps/api/event';
-    import { onMount } from 'svelte';
+    import { onMount, createEventDispatcher } from 'svelte';
 
     import { appState } from '../lib/state.js';
     import { navigate } from '../lib/routing.js';
     import { getRootCause } from '../lib/errors.js';
+
     import ErrorAlert from '../ui/ErrorAlert.svelte';
     import Link from '../ui/Link.svelte';
+    import PassphraseInput from '../ui/PassphraseInput.svelte';
+    import ResetPassphrase from './passphrase/ResetPassphrase.svelte';
     import Spinner from '../ui/Spinner.svelte';
+    import vaultDoorSvg from '../assets/vault_door.svg?raw';
 
 
-    let errorMsg = null;
+    const dispatch = createEventDispatcher();
+
     let alert;
     let passphrase = '';
-    let loadTime = 0;
+    
     let saving = false;
     async function unlock() {
-        // The hotkey for navigating here from homepage is Enter, which also
-        // happens to trigger the form submit event
-        if (Date.now() - loadTime < 10) {
-            return;
-        }
-
+        saving = true;
         try {
-            saving = true;
-            let r = await invoke('unlock', {passphrase});
-            $appState.credentialStatus = 'unlocked';
-            emit('credentials-event', 'unlocked');
-            if ($appState.currentRequest) {
-                navigate('Approve');
-            }
-            else {
-                navigate('Home');
-            }
+            await alert.run(async () => invoke('unlock', {passphrase}));
+            $appState.sessionStatus = 'unlocked';
+            emit('unlocked');
+            dispatch('unlocked');
         }
-        catch (e) {
-            const root = getRootCause(e);
-            if (e.code === 'GetSession' && root.code) {
-                errorMsg = `Error response from AWS (${root.code}): ${root.msg}`;
-            }
-            else {
-                errorMsg = e.msg;
-            }
-            
-            // if the alert already existed, shake it
-            if (alert) {
-                alert.shake();
-            }
-
+        finally {
             saving = false;
         }
-    }
 
-    function cancel() {
-        emit('credentials-event', 'unlock-canceled');
-        navigate('Home');
     }
-
-    onMount(() => {
-        loadTime = Date.now();
-    })
 </script>
 
 
+<div class="fixed top-0 w-full p-2 text-center">
+    <h1 class="text-3xl font-bold">Creddy is locked</h1>
+</div>
+
 <form action="#" on:submit|preventDefault="{unlock}" class="form-control space-y-4 max-w-sm m-auto p-4 h-screen justify-center">
-    <h2 class="font-bold text-2xl text-center">Enter your passphrase</h2>
+    <div class="mx-auto">
+        {@html vaultDoorSvg}
+    </div>
 
-    {#if errorMsg}
-        <ErrorAlert bind:this="{alert}">{errorMsg}</ErrorAlert>
-    {/if}
+    <label class="space-y-4">
+        <h2 class="font-bold text-xl text-center">Please enter your passphrase</h2>
 
-    <!-- svelte-ignore a11y-autofocus -->
-    <input autofocus name="password" type="password" placeholder="correct horse battery staple" bind:value="{passphrase}" class="input input-bordered" />
+        <ErrorAlert bind:this="{alert}" />
+
+        <!-- svelte-ignore a11y-autofocus -->
+        <PassphraseInput autofocus="true" bind:value={passphrase} placeholder="correct horse battery staple" />
+    </label>
 
     <button type="submit" class="btn btn-primary">
         {#if saving}
@@ -82,7 +63,5 @@
         {/if}
     </button>
 
-    <Link target={cancel} hotkey="Escape">
-        <button class="btn btn-sm btn-outline w-full">Cancel</button>
-    </Link>
+    <ResetPassphrase />
 </form>

src/views/approve/CollectResponse.svelte

@@ -0,0 +1,91 @@
+<script>
+    import { createEventDispatcher } from 'svelte';
+    import { appState, cleanupRequest } from '../../lib/state.js';
+
+    import Link from '../../ui/Link.svelte';
+    import KeyCombo from '../../ui/KeyCombo.svelte';
+
+
+    // Executable paths can be long, so ensure they only break on \ or /
+    function breakPath(path) {
+        return path.replace(/(\\|\/)/g, '$1<wbr>');
+    }
+
+    // Extract executable name from full path
+    const client = $appState.currentRequest.client;
+    const m = client.exe?.match(/\/([^/]+?$)|\\([^\\]+?$)/);
+    const appName = m[1] || m[2];
+
+    const dispatch = createEventDispatcher();
+
+    function setResponse(approval, base) {
+        $appState.currentRequest.response = {
+            id: $appState.currentRequest.id,
+            approval,
+            base,
+        };
+        dispatch('response');
+    }
+</script>
+
+
+{#if $appState.currentRequest?.base}
+    <div class="alert alert-warning shadow-lg">
+        <div>
+            <svg xmlns="http://www.w3.org/2000/svg" class="stroke-current flex-shrink-0 h-6 w-6" fill="none" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" /></svg>
+            <span>
+                WARNING: This application is requesting your base AWS credentials. 
+                These credentials are less secure than session credentials, since they don't expire automatically.
+            </span>
+        </div>
+    </div>
+{/if}
+
+<div class="space-y-1 mb-4">
+    <h2 class="text-xl font-bold">{appName ? `"${appName}"` : 'An appplication'} would like to access your AWS credentials.</h2>
+
+    <div class="grid grid-cols-[auto_1fr] gap-x-3">
+        <div class="text-right">Path:</div>
+        <code class="">{@html client.exe ? breakPath(client.exe) : 'Unknown'}</code>
+        <div class="text-right">PID:</div>
+        <code>{client.pid}</code>
+    </div>
+</div>
+
+<div class="w-full grid grid-cols-[1fr_auto] items-center gap-y-6">
+        <!-- Don't display the option to approve with session credentials if base was specifically requested -->
+        {#if !$appState.currentRequest?.base}
+            <h3 class="font-semibold">
+                Approve with session credentials
+            </h3>
+            <Link target={() => setResponse('Approved', false)} hotkey="Enter" shift={true}>
+                <button class="w-full btn btn-success">
+                    <KeyCombo keys={['Shift', 'Enter']} />
+                </button>
+            </Link>
+        {/if}
+
+        <h3 class="font-semibold">
+            <span class="mr-2">
+                {#if $appState.currentRequest?.base}
+                    Approve
+                {:else}
+                    Approve with base credentials
+                {/if}
+            </span>
+        </h3>
+        <Link target={() => setResponse('Approved', true)} hotkey="Enter" shift={true} ctrl={true}>
+            <button class="w-full btn btn-warning">
+                <KeyCombo keys={['Ctrl', 'Shift', 'Enter']} />
+            </button>
+        </Link>
+
+        <h3 class="font-semibold">
+            <span class="mr-2">Deny</span>
+        </h3>
+        <Link target={() => setResponse('Denied', false)} hotkey="Escape">
+            <button class="w-full btn btn-error">
+                <KeyCombo keys={['Esc']} />
+            </button>
+        </Link>
+</div>

src/views/approve/ShowResponse.svelte

@@ -1,8 +1,7 @@
 <script>
-    import { onMount } from 'svelte';
     import { draw, fade } from 'svelte/transition';
 
-    import { appState, completeRequest } from '../lib/state.js';
+    import { appState } from '../../lib/state.js';
     
     let success = false;
     let error = null;
@@ -10,19 +9,11 @@
     let drawDuration = $appState.config.rehide_ms >= 750 ? 500 : 0;
     let fadeDuration = drawDuration * 0.6;
     let fadeDelay = drawDuration * 0.4;
-
-    onMount(() => {
-        window.setTimeout(
-            completeRequest,
-            // Extra 50ms so the window can finish disappearing before the redraw
-            Math.min(5000, $appState.config.rehide_ms + 50),
-        )
-    })
 </script>
 
 
 <div class="flex flex-col h-screen items-center justify-center max-w-max m-auto">
-    {#if $appState.currentRequest.approval === 'Approved'}
+    {#if $appState.currentRequest.response.approval === 'Approved'}
         <svg xmlns="http://www.w3.org/2000/svg" class="w-36 h-36" fill="none" viewBox="0 0 24 24" stroke-width="1" stroke="currentColor">
           <path in:draw="{{duration: drawDuration}}" stroke-linecap="round" stroke-linejoin="round" d="M9 12.75L11.25 15 15 9.75M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
         </svg>
@@ -33,6 +24,6 @@
     {/if}
 
     <div in:fade="{{duration: fadeDuration, delay: fadeDelay}}" class="text-2xl font-bold">
-        {$appState.currentRequest.approval}!
+        {$appState.currentRequest.response.approval}!
     </div>
 </div>

src/views/credentials/AwsCredential.svelte

@@ -0,0 +1,155 @@
+<script>
+    import { createEventDispatcher } from 'svelte';
+    import { fade, slide } from 'svelte/transition';
+    import { invoke } from '@tauri-apps/api/core';
+
+    import ErrorAlert from '../../ui/ErrorAlert.svelte';
+    import Icon from '../../ui/Icon.svelte';
+
+    export let record;
+    export let defaults;
+
+    import PassphraseInput from '../../ui/PassphraseInput.svelte';
+
+
+    const dispatch = createEventDispatcher();
+
+    let showDetails = record.isNew ? true : false;
+
+    let localName = name;
+    let local = JSON.parse(JSON.stringify(record));
+    $: isModified = JSON.stringify(local) !== JSON.stringify(record);
+    
+    // explicitly subscribe to updates to `default`, so that we can update
+    // our local copy even if the component hasn't been recreated
+    // (sadly we can't use a reactive binding because reasons I guess)
+    defaults.subscribe(d => local.is_default = local.id === d[local.credential.type])
+
+    let alert;
+    async function saveCredential() {
+        await invoke('save_credential', {record: local});
+        dispatch('update');
+        showDetails = false;
+    }
+
+    let deleteModal;
+    function conditionalDelete() {
+        if (!record.isNew) {
+            deleteModal.showModal();
+        }
+        else {
+            deleteCredential();
+        }
+    }
+
+    async function deleteCredential() {
+        try {
+            if (!record.isNew) {
+                await invoke('delete_credential', {id: record.id});
+            }
+            dispatch('update');
+        }
+        catch (e) {
+            showDetails = true;
+            // wait for showDetails to take effect and the alert to be rendered
+            window.setTimeout(() => alert.setError(e), 0);
+        }
+    }
+</script>
+
+
+<div 
+    transition:slide|local={{duration: record.isNew ? 300 : 0}}
+    class="rounded-box space-y-4 bg-base-200 {record.is_default ? 'border border-accent' : ''}"
+>
+    <div class="flex items-center px-6 py-4 gap-x-4">
+        <h3 class="text-lg font-bold">{record.name || ''}</h3>
+
+        {#if record.is_default}
+            <span class="badge badge-accent">Default</span>
+        {/if}
+
+        <div class="join ml-auto">
+            <button
+                type="button"
+                class="btn btn-outline join-item"
+                on:click={() => showDetails = !showDetails}
+            >
+                <Icon name="pencil" class="size-6" />
+            </button>
+            <button
+                type="button"
+                class="btn btn-outline btn-error join-item"
+                on:click={conditionalDelete}
+            >
+                <Icon name="trash" class="size-6" />
+            </button>
+        </div>
+    </div>
+
+
+    {#if showDetails}
+        <form
+            transition:slide|local={{duration: 200}}
+            class=" px-6 pb-4 space-y-4"
+            on:submit|preventDefault={() => alert.run(saveCredential)}
+        >
+            <ErrorAlert bind:this={alert} />
+
+            <div class="grid grid-cols-[auto_1fr] items-center gap-4">
+                {#if record.isNew}
+                    <span class="justify-self-end">Name</span>
+                    <input
+                        type="text"
+                        class="input input-bordered bg-transparent"
+                        bind:value={local.name}
+                    >
+                {/if}
+
+                <span class="justify-self-end">Key ID</span>
+                <input
+                    type="text"
+                    class="input input-bordered font-mono bg-transparent"
+                    bind:value={local.credential.AccessKeyId}
+                >
+
+                <span>Secret key</span>
+                <div class="font-mono">
+                    <PassphraseInput class="bg-transparent" bind:value={local.credential.SecretAccessKey} />
+                </div>
+            </div>
+
+            <div class="flex justify-between">
+                <label class="label cursor-pointer justify-self-start space-x-4">
+                    <span class="label-text">Default AWS access key</span>
+                    <input type="checkbox" class="toggle toggle-accent" bind:checked={local.is_default}>
+                </label>
+                {#if isModified}
+                    <button
+                        transition:fade={{duration: 100}}
+                        type="submit"
+                        class="btn btn-primary"
+                        >
+                            Save
+                        </button>
+                {/if}
+            </div>
+        </form>
+    {/if}
+
+    <dialog bind:this={deleteModal} class="modal">
+        <div class="modal-box">
+            <h3 class="text-lg font-bold">Delete AWS credential "{record.name}"?</h3>
+            <div class="modal-action">
+                <form method="dialog" class="flex gap-x-4">
+                    <button class="btn btn-outline">Cancel</button>
+                    <button 
+                        autofocus
+                        class="btn btn-error"
+                        on:click={deleteCredential}
+                    >Delete</button>
+                </form>
+            </div>
+        </div>
+    </dialog>
+</div>

src/views/passphrase/EnterPassphrase.svelte

@@ -0,0 +1,109 @@
+<script>
+    import { createEventDispatcher } from 'svelte';
+    import { invoke } from '@tauri-apps/api/core';
+    import { appState } from '../../lib/state.js';
+
+    import ErrorAlert from '../../ui/ErrorAlert.svelte';
+    import Link from '../../ui/Link.svelte';
+    import PassphraseInput from '../../ui/PassphraseInput.svelte';
+    import ResetPassphrase from './ResetPassphrase.svelte';
+    import Spinner from '../../ui/Spinner.svelte';
+
+    export let cancellable = false;
+
+
+    const dispatch = createEventDispatcher();
+
+    let alert;
+    let saving = false;
+    let passphrase = '';
+    let confirmPassphrase = '';
+
+    // onChange only fires when an input loses focus, so always set the error if not set
+    function onChange() {
+        console.log(`onChange: passphrase=${passphrase}, confirmPassphrase=${confirmPassphrase}`)
+        if (passphrase !== confirmPassphrase) {
+            alert.setError('Passphrases do not match.');
+        }
+        else {
+            alert.setError(null);
+        }
+    }
+    // onInput fires on every keystroke, so only dismiss the error, don't create it
+    function onInput() {
+        console.log(`onInput: passphrase=${passphrase}, confirmPassphrase=${confirmPassphrase}`)
+        if (passphrase === confirmPassphrase) {
+            alert.setError(null);
+        }
+    }
+
+
+    async function save() {
+        if (passphrase !== confirmPassphrase) {
+            return;
+        }
+
+        if (passphrase === '') {
+            alert.setError('Passphrase is empty.')
+            return;
+        }
+
+        saving = true;
+        try {
+            await alert.run(async () => {
+                await invoke('set_passphrase', {passphrase})
+                throw('something bad happened');
+                $appState.sessionStatus = 'unlocked';
+                dispatch('save');
+            });
+        }
+        finally {
+            saving = false;
+        }
+    }
+</script>
+
+
+<form class="form-control gap-y-4" on:submit|preventDefault={save}>
+    <ErrorAlert bind:this={alert} />
+
+    <label class="form-control w-full">
+        <div class="label">
+            <span class="label-text">Passphrase</span>
+        </div>
+        <PassphraseInput
+            bind:value={passphrase}
+            on:input={onInput}
+            placeholder="correct horse battery staple"
+        />
+    </label>
+
+    <label class="form-control w-full">
+        <div class="label">
+            <span class="label-text">Re-enter passphrase</span>
+        </div>
+        <PassphraseInput
+            bind:value={confirmPassphrase}
+            on:input={onInput} on:change={onChange}
+            placeholder="correct horse battery staple"
+        />
+    </label>
+
+    <button type="submit" class="btn btn-primary">
+        {#if saving}
+            <Spinner class="w-5 h-5" thickness="12"/>
+        {:else}
+            Submit
+        {/if}
+    </button>
+
+    {#if cancellable}
+        <Link target="Settings" hotkey="Escape">
+            <button type="button" class="btn btn-outline btn-sm w-full">Cancel</button>
+        </Link>
+    {/if}
+
+    {#if $appState.sessionStatus === 'locked'}
+        <ResetPassphrase />
+    {/if}
+</form>

src/views/passphrase/ResetPassphrase.svelte

@@ -0,0 +1,41 @@
+<script>
+    import { invoke } from '@tauri-apps/api/core';
+    import { appState } from '../../lib/state.js';
+
+    import ErrorAlert from '../../ui/ErrorAlert.svelte';
+
+
+    let modal;
+    let alert;
+
+    async function reset() {
+        await invoke('reset_session');
+        $appState.sessionStatus = 'empty';
+    }
+
+
+</script>
+
+
+<button type="button" class="self-end text-sm text-secondary/75 hover:underline focus:ring-accent" on:click={modal.showModal()}>
+    Reset passphrase
+</button>
+
+<dialog class="modal" bind:this={modal}>
+    <div class="modal-box space-y-6">
+        <ErrorAlert bind:this={alert} />
+        <h3 class="text-lg font-bold">Delete all credentials?</h3>
+        <div class="space-y-2">
+            <p>Credentials are encrypted with your current passphrase and will be lost if the passphrase is reset.</p>
+            <p>Are you sure you want to reset your passphrase and delete all saved credentials?</p>
+        </div>
+        <div class="modal-action">
+            <form method="dialog" class="flex gap-x-4">
+                <button autofocus class="btn btn-outline">Cancel</button>
+                <button class="btn btn-error" on:click|preventDefault={() => alert.run(reset)}>
+                    Reset
+                </button>
+            </form>
+        </div>
+    </div>
+</dialog>

tailwind.config.js

@@ -10,4 +10,40 @@ module.exports = {
   plugins: [
     require('daisyui'),
   ],
+  daisyui: {
+    themes: [
+      {
+        creddy: {
+          "primary": "#0ea5e9",
+          "secondary": "#fb923c",
+          "accent": "#8b5cf6",
+          "neutral": "#2f292c",
+          "base-100": "#252e3a",
+          "info": "#66cccc",
+          "success": "#52bf73",
+          "warning": "#d1a900",
+          "error": "#f87171",
+        },
+      },
+      {
+        "summer-night": {
+          "primary": "#0ea5e9",
+          "secondary": "#0ea5e9",
+          "accent": "#fb923c",
+          "neutral": "#393939",
+          "base-100": "#2d2d2d",
+          "info": "#66cccc",
+          "success": "#22c55e",
+          "warning": "#d1a900",
+          "error": "#f2777a"
+        },
+      },
+      "dark",
+      "night",
+      "dracula",
+      "sunset",
+      "dim",
+      "light"
+    ]
+  },
 }