Investigate permissions on chat.db and .vcf

[Teddarific]

It's going to important to know what the technical limitations are in terms of accessing a chat.db and .vcf

This will help address what the user flow will look like:

1. Can we directly query their chat.db file? (aka nothing is needed from the user beyond asking for permissions?)
2. If not, what are the minimal number of steps the user needs to take in order for us to get an accessible chat.db?

[alexdanilowicz]

Can we directly query their chat.db file? (aka nothing is needed from the user beyond asking for permissions?)

Yes, we can simply do something like:

mkdir ~/.leftonread # hidden dir on root like most other apps
cp ~/Library/Messages/chat.db ~/.leftonread

The user is going to be prompted saying, "LEFT ON READ WOULD LIKE TO ACCESS YOUR COMPUTER"

For contacts, there's a few cases.

I think we are going to have to do this:

cp ~/Library/Application\ Support/AddressBook ~/.leftonread/AddressBook

And then read the AddressBook/Sources folder and look at each *.abcddb to see which is populated. If Sources/ does not exist, then we read the top-level *.abcddb

The user is going to be prompted saying, "LEFT ON READ WOULD LIKE TO ACCESS YOUR CONTACTS"

---

Note, if the user has security software, they are going to additionally prompted with something like this (I saw this on 1/4 computers I tested). Popups like these are a tradeoff if we do not have the user manually copying the chat.db and manually create a .vcf file

[alexdanilowicz]

WIP PR which demonstrates this for the chat.db case is here: #10

The issue is that I'm not sure how this will look in a real packaged build until we follow these steps and sign + notarize the app

[Teddarific]

Got it, thanks for the information. I can look into the signing & notarizing. @alexdanilowicz is this something that would be better to get sooner than later? Or are we confident that what we can reproduce in dev will be what we get when we package in prod?

[alexdanilowicz]

@Teddarific thanks for your response. We are not confident because I'm not sure how permissions will be treated on a production application. On the current dev application it's just "electron" than is asking for permissions. In prod, it will be "Left On Read", and I'd rather not take any chances.

I'd vote to sign and notarize sooner rather than later. @Teddarific. It also be great motivation. Not that we need any 😉