Explain the Keychain prompt and raise the Import window reliably#10
Merged
Explain the Keychain prompt and raise the Import window reliably#10
Conversation
Three UX fixes for the import flow shipped in #9: - Add a per-browser heads-up banner in the Import window. Chromium browsers get a note about the one-time Keychain password prompt and that clicking "Always Allow" removes it from future runs. Safari gets the Full Disk Access note up-front instead of only after a failed attempt. Firefox stays quiet — no OS prompt there. - Attach an LAContext to the Chromium Safe-Storage keychain query (`kSecUseAuthenticationContext`) and a `kSecUseOperationPrompt` message. In practice Chromium-family browsers don't create their Safe-Storage entry with biometric-compatible ACL flags, so macOS still falls back to the password prompt today — but attaching the context is free, gives a nicer in-prompt message, and upgrades to Touch ID automatically the day a fork (or Chromium itself) flips the ACL. - Fix "Sign in button did nothing": `NSApp.activate(ignoringOtherApps:)` was softened in macOS 14 and doesn't reliably pull a fresh window forward from an LSUIElement app. Switch to `NSApp.activate()`, and poll `NSApp.windows` for the new window for up to 500 ms rather than assuming a single-runloop defer is enough — the window isn't always in the list when onAppear fires on first open.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three UX follow-ups on top of the import-from-browser flow in #9:
LAContextviakSecUseAuthenticationContextand a customkSecUseOperationPromptto theSecItemCopyMatchingquery for the Chromium Safe Storage key. In practice Chromium browsers don't create their Safe Storage entry with biometric-compatible ACL flags, so macOS still falls back to the password prompt — but attaching the context costs nothing, gives a nicer in-prompt message, and will upgrade to Touch ID the day a fork (or Chromium itself) flips the ACL.NSApp.activate(ignoringOtherApps:)was softened in macOS 14 and no longer reliably pulls a fresh window forward from anLSUIElementapp. Switch toNSApp.activate(), and pollNSApp.windowsfor the target window for up to 500 ms instead of assuming a single-runloop defer is enough. Fixes the symptom where clicking Sign in left the Import window hidden behind the frontmost app.Test plan