ios/chrome/app/credential_provider_migrator_app_agent.mm - chromium/src.git - Git at Google

 // Copyright 2021 The Chromium Authors
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

 #import "ios/chrome/app/credential_provider_migrator_app_agent.h"

 #import <map>

 #import "base/containers/contains.h"
 #import "base/functional/bind.h"
 #import "base/functional/callback.h"
 #import "base/functional/callback_helpers.h"
 #import "base/memory/raw_ptr.h"
 #import "components/keyed_service/core/service_access_type.h"
 #import "components/password_manager/core/browser/features/password_manager_features_util.h"
 #import "components/password_manager/core/browser/password_form.h"
 #import "components/webauthn/core/browser/passkey_model.h"
 #import "ios/chrome/app/application_delegate/app_state.h"
 #import "ios/chrome/app/profile/profile_state.h"
 #import "ios/chrome/browser/credential_provider/model/credential_provider_browser_agent.h"
 #import "ios/chrome/browser/credential_provider/model/credential_provider_migrator.h"
 #import "ios/chrome/browser/passwords/model/ios_chrome_account_password_store_factory.h"
 #import "ios/chrome/browser/passwords/model/ios_chrome_profile_password_store_factory.h"
 #import "ios/chrome/browser/shared/coordinator/scene/scene_state.h"
 #import "ios/chrome/browser/shared/model/application_context/application_context.h"
 #import "ios/chrome/browser/shared/model/browser/browser.h"
 #import "ios/chrome/browser/shared/model/browser/browser_list.h"
 #import "ios/chrome/browser/shared/model/browser/browser_list_factory.h"
 #import "ios/chrome/browser/shared/model/browser/browser_provider.h"
 #import "ios/chrome/browser/shared/model/browser/browser_provider_interface.h"
 #import "ios/chrome/browser/shared/model/profile/features.h"
 #import "ios/chrome/browser/shared/model/profile/profile_ios.h"
 #import "ios/chrome/browser/shared/model/profile/profile_manager_ios.h"
 #import "ios/chrome/browser/sync/model/sync_service_factory.h"
 #import "ios/chrome/browser/webauthn/model/ios_passkey_model_factory.h"
 #import "ios/chrome/common/app_group/app_group_constants.h"
 #import "ios/chrome/common/credential_provider/constants.h"
 #import "ios/chrome/common/credential_provider/credential_provider_creation_notifier.h"
 #import "ios/chrome/common/credential_provider/passkey_model_observer_bridge.h"

 @interface CredentialProviderMigratorAppAgent () <PasskeyModelObserverDelegate>

 // Invoked when -startMigrationWithCompletion: completes for a given profile.
 // The `profile` pointer may be null if the profile has been destroyed before
 // the callback is invoked.
 - (void)migrationCompleteForProfile:(ProfileIOS*)profile
                         profileName:(const std::string&)profileName;

 @end

 namespace {

 // Helper function that call -migrationCompleteForProfile:... while allowing
 // to use base::BindOnce(...) which is safer as is avoid capturing implicitly
 // pointer to C++ objects.
 void MigrationCompleteForProfile(
     __weak CredentialProviderMigratorAppAgent* app_agent,
     base::WeakPtr<ProfileIOS> weak_profile,
     const std::string& profile_name,
     BOOL success,
     NSError* error) {
   DCHECK(success) << error.localizedDescription;
   [app_agent migrationCompleteForProfile:weak_profile.get()
                              profileName:profile_name];
 }

 }  // namespace

 @implementation CredentialProviderMigratorAppAgent {
   CredentialProviderCreationNotifier* _credentialProviderCreationNotifier;

   // Maps of PasskeyModel to the registered observer.
   std::map<webauthn::PasskeyModel*,
            std::unique_ptr<webauthn::PasskeyModel::Observer>>
       _passkeyModelObservers;

   // Maps profile name to the CredentialProviderMigrator responsible for the
   // profile's migration.
   std::map<std::string, CredentialProviderMigrator*, std::less<>> _migratorMap;
 }

 - (instancetype)init {
   self = [super init];
   if (self) {
     __weak __typeof__(self) weakSelf = self;
     _credentialProviderCreationNotifier =
         [[CredentialProviderCreationNotifier alloc] initWithBlock:^() {
           [weakSelf migrateCredentialForAllPasskeyModels];
         }];
   }
   return self;
 }

 #pragma mark - SceneObservingAppAgent

 // Migrate the password when Chrome comes to foreground.
 - (void)appDidEnterForeground {
   [self migrateCredentialForAllPasskeyModels];
 }

 #pragma mark - AppStateObserver

 // Called when a new ProfileState is connected.
 - (void)appState:(AppState*)appState
     profileStateConnected:(ProfileState*)profileState {
   [self updateMultiProfileSetting];
 }

 // Called when a ProfileState is disconnected.
 - (void)appState:(AppState*)appState
     profileStateDisconnected:(ProfileState*)profileState {
   [self updateMultiProfileSetting];
 }

 #pragma mark - PasskeyModelObserverDelegate

 - (void)passKeyModelShuttingDown:(webauthn::PasskeyModel*)passkeyModel {
   [self removeObserverForPasskeyModel:passkeyModel];
 }

 - (void)passkeyModelIsReady:(webauthn::PasskeyModel*)passkeyModel {
   const std::vector<ProfileIOS*> loadedProfiles =
       GetApplicationContext()->GetProfileManager()->GetLoadedProfiles();

   const auto iter =
       std::ranges::find_if(loadedProfiles, [passkeyModel](ProfileIOS* profile) {
         return IOSPasskeyModelFactory::GetForProfile(profile) == passkeyModel;
       });

   if (iter != loadedProfiles.end()) {
     NSString* key = AppGroupUserDefaultsCredentialProviderNewCredentials();
     NSUserDefaults* userDefaults = app_group::GetGroupUserDefaults();

     [self migrateCredentialForProfile:*iter
                          passKeyModel:passkeyModel
                                   key:key
                          userDefaults:userDefaults];
   }
 }

 #pragma mark - Private

 // Returns whether multiple profiles have at least one scene connected.
 - (BOOL)isMultiProfile {
   if (!AreSeparateProfilesForManagedAccountsEnabled()) {
     return NO;
   }

   // Check if we have more than 1 connected profile.
   NSUInteger profileWithScenes = 0;
   for (ProfileState* profileState in self.appState.profileStates) {
     if ([profileState.connectedScenes count] != 0) {
       profileWithScenes++;
     }
   }

   return profileWithScenes > 1;
 }

 // Updates the CPE's multi profile setting.
 - (void)updateMultiProfileSetting {
   [app_group::GetGroupUserDefaults()
       setObject:[NSNumber numberWithBool:[self isMultiProfile]]
          forKey:AppGroupUserDefaultsCredentialProviderMultiProfileSetting()];
 }

 // Sets whether the passkey updates are allowed to show an infobar to the user.
 // This should normally only happen during the credential migration.
 - (void)allowInfobarForProfile:(ProfileIOS*)profile allowed:(BOOL)allowed {
   BrowserList* browserList = BrowserListFactory::GetForProfile(profile);
   for (Browser* browser :
        browserList->BrowsersOfType(BrowserList::BrowserType::kAll)) {
     if (auto* agent = CredentialProviderBrowserAgent::FromBrowser(browser)) {
       agent->SetInfobarAllowed(allowed);
     }
   }
 }

 // Migrates the credential for all passkey models.
 - (void)migrateCredentialForAllPasskeyModels {
   NSString* key = AppGroupUserDefaultsCredentialProviderNewCredentials();
   NSUserDefaults* userDefaults = app_group::GetGroupUserDefaults();

   const std::vector<ProfileIOS*> loadedProfiles =
       GetApplicationContext()->GetProfileManager()->GetLoadedProfiles();

   for (ProfileIOS* profile : loadedProfiles) {
     webauthn::PasskeyModel* passkeyModel =
         IOSPasskeyModelFactory::GetForProfile(profile);

     [self migrateCredentialForProfile:profile
                          passKeyModel:passkeyModel
                                   key:key
                          userDefaults:userDefaults];
   }
 }

 // Migrate the credential for the given profile and model.
 - (void)migrateCredentialForProfile:(ProfileIOS*)profile
                        passKeyModel:(webauthn::PasskeyModel*)passkeyModel
                                 key:(NSString*)key
                        userDefaults:(NSUserDefaults*)userDefaults {
   CHECK(profile);
   // Do nothing if the migration for the profile already started.
   if (base::Contains(_migratorMap, profile->GetProfileName())) {
     return;
   }

   // If the passkey model isn't ready, delay the migration of passkeys until
   // it is ready.
   if (passkeyModel && !passkeyModel->IsReady()) {
     if (![self isObservingPasskeyModel:passkeyModel]) {
       [self addObserverForPasskeyModel:passkeyModel];
     }
     return;
   }

   password_manager::PasswordForm::Store defaultStore =
       password_manager::features_util::IsAccountStorageEnabled(
           SyncServiceFactory::GetForProfile(profile))
           ? password_manager::PasswordForm::Store::kAccountStore
           : password_manager::PasswordForm::Store::kProfileStore;
   scoped_refptr<password_manager::PasswordStoreInterface> storeToSave =
       defaultStore == password_manager::PasswordForm::Store::kAccountStore
           ? IOSChromeAccountPasswordStoreFactory::GetForProfile(
                 profile, ServiceAccessType::IMPLICIT_ACCESS)
           : IOSChromeProfilePasswordStoreFactory::GetForProfile(
                 profile, ServiceAccessType::IMPLICIT_ACCESS);

   CredentialProviderMigrator* migrator =
       [[CredentialProviderMigrator alloc] initWithUserDefaults:userDefaults
                                                            key:key
                                                  passwordStore:storeToSave
                                                   passkeyStore:passkeyModel];
   _migratorMap.insert(std::make_pair(profile->GetProfileName(), migrator));
   [self allowInfobarForProfile:profile allowed:YES];

   __weak __typeof__(self) weakSelf = self;
   [migrator startMigrationWithCompletion:base::CallbackToBlock(base::BindOnce(
                                              &MigrationCompleteForProfile,
                                              weakSelf, profile->AsWeakPtr(),
                                              profile->GetProfileName()))];
 }

 - (void)migrationCompleteForProfile:(ProfileIOS*)profile
                         profileName:(const std::string&)profileName {
   auto iter = _migratorMap.find(profileName);
   CHECK(iter != _migratorMap.end());
   _migratorMap.erase(iter);
   if (!profile) {
     return;
   }

   webauthn::PasskeyModel* passkeyModel =
       IOSPasskeyModelFactory::GetForProfile(profile);
   if ([self isObservingPasskeyModel:passkeyModel]) {
     [self removeObserverForPasskeyModel:passkeyModel];
   }

   [self allowInfobarForProfile:profile allowed:NO];
 }

 // Returns whether we already own an observer for the provided passkey model.
 - (BOOL)isObservingPasskeyModel:(webauthn::PasskeyModel*)passkeyModel {
   return base::Contains(_passkeyModelObservers, passkeyModel);
 }

 // Adds an observer for the provided passkey model.
 - (void)addObserverForPasskeyModel:(webauthn::PasskeyModel*)passkeyModel {
   CHECK(![self isObservingPasskeyModel:passkeyModel]);
   _passkeyModelObservers.insert(std::make_pair(
       passkeyModel,
       std::make_unique<PasskeyModelObserverBridge>(self, passkeyModel)));
 }

 // Removes an observer for the provided passkey model.
 - (void)removeObserverForPasskeyModel:(webauthn::PasskeyModel*)passkeyModel {
   CHECK([self isObservingPasskeyModel:passkeyModel]);
   _passkeyModelObservers.erase(passkeyModel);
 }

 @end
	// Copyright 2021 The Chromium Authors
	// Use of this source code is governed by a BSD-style license that can be
	// found in the LICENSE file.

	#import "ios/chrome/app/credential_provider_migrator_app_agent.h"

	#import <map>

	#import "base/containers/contains.h"
	#import "base/functional/bind.h"
	#import "base/functional/callback.h"
	#import "base/functional/callback_helpers.h"
	#import "base/memory/raw_ptr.h"
	#import "components/keyed_service/core/service_access_type.h"
	#import "components/password_manager/core/browser/features/password_manager_features_util.h"
	#import "components/password_manager/core/browser/password_form.h"
	#import "components/webauthn/core/browser/passkey_model.h"
	#import "ios/chrome/app/application_delegate/app_state.h"
	#import "ios/chrome/app/profile/profile_state.h"
	#import "ios/chrome/browser/credential_provider/model/credential_provider_browser_agent.h"
	#import "ios/chrome/browser/credential_provider/model/credential_provider_migrator.h"
	#import "ios/chrome/browser/passwords/model/ios_chrome_account_password_store_factory.h"
	#import "ios/chrome/browser/passwords/model/ios_chrome_profile_password_store_factory.h"
	#import "ios/chrome/browser/shared/coordinator/scene/scene_state.h"
	#import "ios/chrome/browser/shared/model/application_context/application_context.h"
	#import "ios/chrome/browser/shared/model/browser/browser.h"
	#import "ios/chrome/browser/shared/model/browser/browser_list.h"
	#import "ios/chrome/browser/shared/model/browser/browser_list_factory.h"
	#import "ios/chrome/browser/shared/model/browser/browser_provider.h"
	#import "ios/chrome/browser/shared/model/browser/browser_provider_interface.h"
	#import "ios/chrome/browser/shared/model/profile/features.h"
	#import "ios/chrome/browser/shared/model/profile/profile_ios.h"
	#import "ios/chrome/browser/shared/model/profile/profile_manager_ios.h"
	#import "ios/chrome/browser/sync/model/sync_service_factory.h"
	#import "ios/chrome/browser/webauthn/model/ios_passkey_model_factory.h"
	#import "ios/chrome/common/app_group/app_group_constants.h"
	#import "ios/chrome/common/credential_provider/constants.h"
	#import "ios/chrome/common/credential_provider/credential_provider_creation_notifier.h"
	#import "ios/chrome/common/credential_provider/passkey_model_observer_bridge.h"

	@interface CredentialProviderMigratorAppAgent () <PasskeyModelObserverDelegate>

	// Invoked when -startMigrationWithCompletion: completes for a given profile.
	// The `profile` pointer may be null if the profile has been destroyed before
	// the callback is invoked.
	- (void)migrationCompleteForProfile:(ProfileIOS*)profile
	profileName:(const std::string&)profileName;

	@end

	namespace {

	// Helper function that call -migrationCompleteForProfile:... while allowing
	// to use base::BindOnce(...) which is safer as is avoid capturing implicitly
	// pointer to C++ objects.
	void MigrationCompleteForProfile(
	__weak CredentialProviderMigratorAppAgent* app_agent,
	base::WeakPtr<ProfileIOS> weak_profile,
	const std::string& profile_name,
	BOOL success,
	NSError* error) {
	DCHECK(success) << error.localizedDescription;
	[app_agent migrationCompleteForProfile:weak_profile.get()
	profileName:profile_name];
	}

	} // namespace

	@implementation CredentialProviderMigratorAppAgent {
	CredentialProviderCreationNotifier* _credentialProviderCreationNotifier;

	// Maps of PasskeyModel to the registered observer.
	std::map<webauthn::PasskeyModel*,
	std::unique_ptr<webauthn::PasskeyModel::Observer>>
	_passkeyModelObservers;

	// Maps profile name to the CredentialProviderMigrator responsible for the
	// profile's migration.
	std::map<std::string, CredentialProviderMigrator*, std::less<>> _migratorMap;
	}

	- (instancetype)init {
	self = [super init];
	if (self) {
	__weak __typeof__(self) weakSelf = self;
	_credentialProviderCreationNotifier =
	[[CredentialProviderCreationNotifier alloc] initWithBlock:^() {
	[weakSelf migrateCredentialForAllPasskeyModels];
	}];
	}
	return self;
	}

	#pragma mark - SceneObservingAppAgent

	// Migrate the password when Chrome comes to foreground.
	- (void)appDidEnterForeground {
	[self migrateCredentialForAllPasskeyModels];
	}

	#pragma mark - AppStateObserver

	// Called when a new ProfileState is connected.
	- (void)appState:(AppState*)appState
	profileStateConnected:(ProfileState*)profileState {
	[self updateMultiProfileSetting];
	}

	// Called when a ProfileState is disconnected.
	- (void)appState:(AppState*)appState
	profileStateDisconnected:(ProfileState*)profileState {
	[self updateMultiProfileSetting];
	}

	#pragma mark - PasskeyModelObserverDelegate

	- (void)passKeyModelShuttingDown:(webauthn::PasskeyModel*)passkeyModel {
	[self removeObserverForPasskeyModel:passkeyModel];
	}

	- (void)passkeyModelIsReady:(webauthn::PasskeyModel*)passkeyModel {
	const std::vector<ProfileIOS*> loadedProfiles =
	GetApplicationContext()->GetProfileManager()->GetLoadedProfiles();

	const auto iter =
	std::ranges::find_if(loadedProfiles, [passkeyModel](ProfileIOS* profile) {
	return IOSPasskeyModelFactory::GetForProfile(profile) == passkeyModel;
	});

	if (iter != loadedProfiles.end()) {
	NSString* key = AppGroupUserDefaultsCredentialProviderNewCredentials();
	NSUserDefaults* userDefaults = app_group::GetGroupUserDefaults();

	[self migrateCredentialForProfile:*iter
	passKeyModel:passkeyModel
	key:key
	userDefaults:userDefaults];
	}
	}

	#pragma mark - Private

	// Returns whether multiple profiles have at least one scene connected.
	- (BOOL)isMultiProfile {
	if (!AreSeparateProfilesForManagedAccountsEnabled()) {
	return NO;
	}

	// Check if we have more than 1 connected profile.
	NSUInteger profileWithScenes = 0;
	for (ProfileState* profileState in self.appState.profileStates) {
	if ([profileState.connectedScenes count] != 0) {
	profileWithScenes++;
	}
	}

	return profileWithScenes > 1;
	}

	// Updates the CPE's multi profile setting.
	- (void)updateMultiProfileSetting {
	[app_group::GetGroupUserDefaults()
	setObject:[NSNumber numberWithBool:[self isMultiProfile]]
	forKey:AppGroupUserDefaultsCredentialProviderMultiProfileSetting()];
	}

	// Sets whether the passkey updates are allowed to show an infobar to the user.
	// This should normally only happen during the credential migration.
	- (void)allowInfobarForProfile:(ProfileIOS*)profile allowed:(BOOL)allowed {
	BrowserList* browserList = BrowserListFactory::GetForProfile(profile);
	for (Browser* browser :
	browserList->BrowsersOfType(BrowserList::BrowserType::kAll)) {
	if (auto* agent = CredentialProviderBrowserAgent::FromBrowser(browser)) {
	agent->SetInfobarAllowed(allowed);
	}
	}
	}

	// Migrates the credential for all passkey models.
	- (void)migrateCredentialForAllPasskeyModels {
	NSString* key = AppGroupUserDefaultsCredentialProviderNewCredentials();
	NSUserDefaults* userDefaults = app_group::GetGroupUserDefaults();

	const std::vector<ProfileIOS*> loadedProfiles =
	GetApplicationContext()->GetProfileManager()->GetLoadedProfiles();

	for (ProfileIOS* profile : loadedProfiles) {
	webauthn::PasskeyModel* passkeyModel =
	IOSPasskeyModelFactory::GetForProfile(profile);

	[self migrateCredentialForProfile:profile
	passKeyModel:passkeyModel
	key:key
	userDefaults:userDefaults];
	}
	}

	// Migrate the credential for the given profile and model.
	- (void)migrateCredentialForProfile:(ProfileIOS*)profile
	passKeyModel:(webauthn::PasskeyModel*)passkeyModel
	key:(NSString*)key
	userDefaults:(NSUserDefaults*)userDefaults {
	CHECK(profile);
	// Do nothing if the migration for the profile already started.
	if (base::Contains(_migratorMap, profile->GetProfileName())) {
	return;
	}

	// If the passkey model isn't ready, delay the migration of passkeys until
	// it is ready.
	if (passkeyModel && !passkeyModel->IsReady()) {
	if (![self isObservingPasskeyModel:passkeyModel]) {
	[self addObserverForPasskeyModel:passkeyModel];
	}
	return;
	}

	password_manager::PasswordForm::Store defaultStore =
	password_manager::features_util::IsAccountStorageEnabled(
	SyncServiceFactory::GetForProfile(profile))
	? password_manager::PasswordForm::Store::kAccountStore
	: password_manager::PasswordForm::Store::kProfileStore;
	scoped_refptr<password_manager::PasswordStoreInterface> storeToSave =
	defaultStore == password_manager::PasswordForm::Store::kAccountStore
	? IOSChromeAccountPasswordStoreFactory::GetForProfile(
	profile, ServiceAccessType::IMPLICIT_ACCESS)
	: IOSChromeProfilePasswordStoreFactory::GetForProfile(
	profile, ServiceAccessType::IMPLICIT_ACCESS);

	CredentialProviderMigrator* migrator =
	[[CredentialProviderMigrator alloc] initWithUserDefaults:userDefaults
	key:key
	passwordStore:storeToSave
	passkeyStore:passkeyModel];
	_migratorMap.insert(std::make_pair(profile->GetProfileName(), migrator));
	[self allowInfobarForProfile:profile allowed:YES];

	__weak __typeof__(self) weakSelf = self;
	[migrator startMigrationWithCompletion:base::CallbackToBlock(base::BindOnce(
	&MigrationCompleteForProfile,
	weakSelf, profile->AsWeakPtr(),
	profile->GetProfileName()))];
	}

	- (void)migrationCompleteForProfile:(ProfileIOS*)profile
	profileName:(const std::string&)profileName {
	auto iter = _migratorMap.find(profileName);
	CHECK(iter != _migratorMap.end());
	_migratorMap.erase(iter);
	if (!profile) {
	return;
	}

	webauthn::PasskeyModel* passkeyModel =
	IOSPasskeyModelFactory::GetForProfile(profile);
	if ([self isObservingPasskeyModel:passkeyModel]) {
	[self removeObserverForPasskeyModel:passkeyModel];
	}

	[self allowInfobarForProfile:profile allowed:NO];
	}

	// Returns whether we already own an observer for the provided passkey model.
	- (BOOL)isObservingPasskeyModel:(webauthn::PasskeyModel*)passkeyModel {
	return base::Contains(_passkeyModelObservers, passkeyModel);
	}

	// Adds an observer for the provided passkey model.
	- (void)addObserverForPasskeyModel:(webauthn::PasskeyModel*)passkeyModel {
	CHECK(![self isObservingPasskeyModel:passkeyModel]);
	_passkeyModelObservers.insert(std::make_pair(
	passkeyModel,
	std::make_unique<PasskeyModelObserverBridge>(self, passkeyModel)));
	}

	// Removes an observer for the provided passkey model.
	- (void)removeObserverForPasskeyModel:(webauthn::PasskeyModel*)passkeyModel {
	CHECK([self isObservingPasskeyModel:passkeyModel]);
	_passkeyModelObservers.erase(passkeyModel);
	}

	@end