Add Phase 2 package policy editor

.github/workflows/build-release.yml

@@ -216,6 +216,13 @@ jobs:
             throw "Windows app host was not produced at unigetui_bin/UniGetUI.exe"
           }
 
+          # The elevated policy-write helper is authenticated by exact path at runtime, and it must
+          # be present here so the code-signing step below signs it and the integrity tree that is
+          # generated afterwards covers it.
+          if (-not (Test-Path "unigetui_bin/Assets/Utilities/UniGetUI.PolicyElevator.exe")) {
+            throw "Elevated policy helper was not staged at unigetui_bin/Assets/Utilities/UniGetUI.PolicyElevator.exe"
+          }
+
           $MaxShippedPdbSizeBytes = 1MB
           $PdbsToRemove = Get-ChildItem "unigetui_bin" -Filter "*.pdb" -File -Recurse | Where-Object {
             $_.Length -gt $MaxShippedPdbSizeBytes
@@ -247,6 +254,14 @@ jobs:
             -CertificateName '${{ secrets.CODE_SIGNING_CERTIFICATE_NAME }}' `
             -TimestampServer '${{ vars.CODE_SIGNING_TIMESTAMP_SERVER }}'
 
+          # The helper is the one binary whose signature is checked at runtime by the host before
+          # it is elevated, so an unsigned helper must fail the release rather than ship.
+          $HelperPath = Join-Path $PWD "unigetui_bin/Assets/Utilities/UniGetUI.PolicyElevator.exe"
+          $HelperSignature = Get-AuthenticodeSignature $HelperPath
+          if ($HelperSignature.Status -ne "Valid") {
+            throw "Elevated policy helper is not validly signed (status: $($HelperSignature.Status))."
+          }
+
       - name: Build installer
         shell: pwsh
         run: |

UniGetUI.iss

@@ -130,6 +130,8 @@ begin
     // Elevator (gsudo cache) and pinget live in {app} and lock their own files.
     TaskKillWait('UniGetUI Elevator.exe');
     TaskKillWait('pinget.exe');
+    // The elevated policy helper is short-lived, but it lives in {app} and can hold a file lock.
+    TaskKillWait('UniGetUI.PolicyElevator.exe');
     Sleep(1000); // let the OS release file handles before copying
 
 end;
@@ -346,3 +348,9 @@ Filename: "{app}\{#MyAppExeName}"; Parameters: "--migrate-wingetui-to-unigetui";
 Filename: {sys}\taskkill.exe; Parameters: "/f /im WingetUI.exe"; Flags: skipifdoesntexist runhidden; RunOnceId: "KillWingetUI"
 Filename: {sys}\taskkill.exe; Parameters: "/f /im UniGetUI.exe"; Flags: skipifdoesntexist runhidden; RunOnceId: "KillUniGetUI"
 Filename: {sys}\taskkill.exe; Parameters: "/f /im UniGetUI.Avalonia.exe"; Flags: skipifdoesntexist runhidden; RunOnceId: "KillUniGetUIAvalonia"
+Filename: {sys}\taskkill.exe; Parameters: "/f /im UniGetUI.PolicyElevator.exe"; Flags: skipifdoesntexist runhidden; RunOnceId: "KillUniGetUIPolicyElevator"
+
+[UninstallDelete]
+; The elevated policy helper is authenticated by exact path, so a leftover copy must never
+; survive an uninstall.
+Type: files; Name: "{app}\Assets\Utilities\UniGetUI.PolicyElevator.exe"

scripts/build.ps1

@@ -96,6 +96,13 @@ if (-not (Test-Path $WindowsAppHostPath)) {
     throw "Windows app host was not produced at $WindowsAppHostPath"
 }
 
+# The elevated policy-write helper is authenticated by exact path at runtime, so a missing or
+# misplaced helper must fail the build rather than silently ship an install that cannot elevate.
+$PolicyElevatorPath = Join-Path $BinDir "Assets\Utilities\UniGetUI.PolicyElevator.exe"
+if (-not (Test-Path $PolicyElevatorPath)) {
+    throw "Elevated policy helper was not staged at $PolicyElevatorPath"
+}
+
 # Keep smaller symbols for useful local crash source information, and prune oversized ones.
 $MaxShippedPdbSizeBytes = 1MB
 

src/UniGetUI.AgentPolicy.ElevatedHelper/PolicyElevationHelperStageTimeouts.cs

@@ -0,0 +1,32 @@
+namespace UniGetUI.AgentPolicy.ElevatedHelper;
+
+internal sealed class PolicyElevationHelperStageTimeouts : IDisposable
+{
+    private readonly TimeSpan _exchangeTimeout;
+    private CancellationTokenSource? _stage;
+    private bool _exchangeStarted;
+
+    public PolicyElevationHelperStageTimeouts(TimeSpan connectTimeout, TimeSpan exchangeTimeout)
+    {
+        _exchangeTimeout = exchangeTimeout;
+        _stage = new CancellationTokenSource(connectTimeout);
+    }
+
+    public CancellationToken Token =>
+        _stage?.Token ?? throw new ObjectDisposedException(nameof(PolicyElevationHelperStageTimeouts));
+
+    public void BeginExchange()
+    {
+        ObjectDisposedException.ThrowIf(_stage is null, this);
+        if (_exchangeStarted)
+            throw new InvalidOperationException("The helper exchange timeout has already started.");
+
+        _exchangeStarted = true;
+        CancellationTokenSource connectStage = _stage;
+        _stage = new CancellationTokenSource(_exchangeTimeout);
+        connectStage.Dispose();
+    }
+
+    public void Dispose() =>
+        Interlocked.Exchange(ref _stage, null)?.Dispose();
+}

src/UniGetUI.AgentPolicy.ElevatedHelper/PolicyElevationHelperSynchronousStageRunner.cs

@@ -0,0 +1,61 @@
+namespace UniGetUI.AgentPolicy.ElevatedHelper;
+
+internal readonly record struct PolicyElevationHelperSynchronousStageResult<T>(
+    bool Completed,
+    T Value)
+{
+    public static PolicyElevationHelperSynchronousStageResult<T> TimedOut =>
+        new(false, default!);
+}
+
+internal static class PolicyElevationHelperSynchronousStageRunner
+{
+    public static async Task<PolicyElevationHelperSynchronousStageResult<T>> RunAsync<T>(
+        Func<T> operation,
+        CancellationToken cancellationToken,
+        Action<T>? disposeAbandonedResult = null,
+        Action? cleanupAfterAbandonedWork = null)
+    {
+        cancellationToken.ThrowIfCancellationRequested();
+        Task<T> worker = Task.Run(
+            () =>
+            {
+                cancellationToken.ThrowIfCancellationRequested();
+                return operation();
+            },
+            CancellationToken.None);
+
+        try
+        {
+            T result = await worker.WaitAsync(cancellationToken).ConfigureAwait(false);
+            return new(true, result);
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+            Task cleanup = worker.ContinueWith(
+                completed =>
+                {
+                    try
+                    {
+                        if (completed.Status == TaskStatus.RanToCompletion)
+                            disposeAbandonedResult?.Invoke(completed.Result);
+                        else
+                            _ = completed.Exception;
+                    }
+                    finally
+                    {
+                        cleanupAfterAbandonedWork?.Invoke();
+                    }
+                },
+                CancellationToken.None,
+                TaskContinuationOptions.ExecuteSynchronously,
+                TaskScheduler.Default);
+            _ = cleanup.ContinueWith(
+                static faulted => _ = faulted.Exception,
+                CancellationToken.None,
+                TaskContinuationOptions.OnlyOnFaulted | TaskContinuationOptions.ExecuteSynchronously,
+                TaskScheduler.Default);
+            return PolicyElevationHelperSynchronousStageResult<T>.TimedOut;
+        }
+    }
+}

src/UniGetUI.AgentPolicy.ElevatedHelper/PolicyReplacementExecutor.cs

@@ -0,0 +1,112 @@
+using System.Text.Json;
+using Devolutions.Now.Policy.Api;
+using Devolutions.Now.Policy.Client;
+using UniGetUI.PackageEngine.AgentBroker.PolicyWriteElevation;
+using UniGetUI.PackageEngine.AgentBroker.PolicyWriteElevation.Interop;
+
+namespace UniGetUI.AgentPolicy.ElevatedHelper;
+
+/// <summary>
+/// Turns the single broker replacement call into the bounded response frame contract.
+/// </summary>
+internal static class PolicyReplacementExecutor
+{
+    public static async Task<PolicyElevationResponseMessage> ExecuteAsync(
+        PolicyElevationRequestMessage request,
+        string effectiveUser,
+        CancellationToken cancellationToken)
+    {
+        var response = new PolicyElevationResponseMessage
+        {
+            ProtocolVersion = PolicyElevationProtocol.Version,
+            RequestId = request.RequestId,
+        };
+
+        try
+        {
+            using var client = new BrokerClient(CreateClientOptions(effectiveUser));
+
+            PolicyReplacementResponse replacement =
+                await PolicyElevationReplacementDispatcher.DispatchAsync(
+                    request,
+                    client.ReplacePolicy,
+                    cancellationToken).ConfigureAwait(false);
+
+            response.Disposition = PolicyElevationDisposition.Committed;
+            response.CommittedStoreToken = replacement.Management.StoreToken;
+            PolicyElevationFrame.ValidateResponse(response);
+            return response;
+        }
+        catch (BrokerClientException ex)
+        {
+            response.Disposition = ex.Kind is
+                BrokerClientErrorKind.BrokerUnavailable
+                or BrokerClientErrorKind.Timeout
+                or BrokerClientErrorKind.EmptyResponse
+                or BrokerClientErrorKind.InvalidResponse
+                    ? PolicyElevationDisposition.Unknown
+                    : PolicyElevationDisposition.Rejected;
+            response.BrokerStatusCode = ex.StatusCode;
+            response.BrokerErrorCode = Truncate(
+                ex.BrokerError?.Code.ToString() ?? ex.Kind.ToString(),
+                PolicyElevationProtocol.MaxBrokerErrorCodeCharacters);
+            if (response.Disposition == PolicyElevationDisposition.Rejected
+                && ex.BrokerError is
+                {
+                    Code: ErrorCode.StalePolicyStoreToken,
+                    Management: not null,
+                } stale)
+            {
+                response.ConflictStoreToken = stale.Management.StoreToken;
+                response.ConflictState = stale.Management.State switch
+                {
+                    PolicyManagementState.Active => PolicyElevationManagementState.Active,
+                    PolicyManagementState.Missing => PolicyElevationManagementState.Missing,
+                    PolicyManagementState.Invalid => PolicyElevationManagementState.Invalid,
+                    _ => throw new InvalidDataException("The stale response carried an invalid management state."),
+                };
+                response.ConflictPolicyId = stale.Management.Policy?.Metadata.Id;
+            }
+            return response;
+        }
+        catch (OperationCanceledException)
+        {
+            response.Disposition = PolicyElevationDisposition.Unknown;
+            response.BrokerErrorCode = BrokerClientErrorKind.Timeout.ToString();
+            return response;
+        }
+        catch (Exception ex) when (ex is IOException or InvalidOperationException or JsonException)
+        {
+            response.Disposition = PolicyElevationDisposition.Unknown;
+            response.BrokerErrorCode = BrokerClientErrorKind.InvalidResponse.ToString();
+            return response;
+        }
+    }
+
+    internal static BrokerClientOptions CreateClientOptions(string effectiveUser)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(effectiveUser);
+        if (!WindowsProcessInspector.IsValidEffectiveUser(effectiveUser))
+        {
+            throw new ArgumentException("The effective user is not a bounded Windows account name.", nameof(effectiveUser));
+        }
+
+        return new BrokerClientOptions
+        {
+            RequestedElevation = Elevation.Elevated,
+            EffectiveUser = effectiveUser,
+            ClientExecutablePath = Environment.ProcessPath,
+            ClientVersion = typeof(PolicyReplacementExecutor).Assembly.GetName().Version?.ToString(),
+        };
+    }
+
+    private static string? Truncate(string? value, int maxCharacters)
+    {
+        if (value is null)
+        {
+            return null;
+        }
+
+        return value.Length <= maxCharacters ? value : value[..maxCharacters];
+    }
+}