fix(app): connect desktop bridge and native keyring

Author: CartagoGit

packages/app/src/app/core/api/host-bridge.client.ts

@@ -7,17 +7,56 @@ import type {
 
 @Injectable({ providedIn: "root" })
 export class HostBridgeClient implements IHostBridge {
+  private nextId = 0;
+  private readonly listeners = new Set<(event: unknown) => void>();
+  private readonly pending = new Map<string, { resolve(value: unknown): void; reject(error: Error): void }>();
+
   request<K extends keyof IHostRequestMap>(
     operation: K,
     input: IHostRequestMap[K],
   ): Promise<IHostResponseMap[K]> {
-    void operation;
-    void input;
-    return Promise.reject(new Error("Host bridge is not connected"));
+    const id = `ui-${++this.nextId}`;
+    const frame = JSON.stringify({ jsonrpc: "2.0", id, method: operation, params: input ?? {} });
+    const tauri = (globalThis as { __TAURI__?: { invoke?: (command: string, args?: Record<string, unknown>) => Promise<unknown>; event?: { listen?: (name: string, callback: (event: { payload: unknown }) => void) => Promise<() => void> } } }).__TAURI__;
+    if (tauri?.invoke) return this.requestTauri(id, frame, tauri) as Promise<IHostResponseMap[K]>;
+    return this.requestBrowser(frame) as Promise<IHostResponseMap[K]>;
   }
 
   subscribe(listener: (event: unknown) => void): () => void {
-    void listener;
-    return () => undefined;
+    this.listeners.add(listener);
+    const tauri = (globalThis as { __TAURI__?: { event?: { listen?: (name: string, callback: (event: { payload: unknown }) => void) => Promise<() => void> } } }).__TAURI__;
+    void tauri?.event?.listen?.("tanit://ipc-message", (event) => {
+      this.dispatchEvent(event.payload);
+      listener(event.payload);
+    });
+    return () => this.listeners.delete(listener);
+  }
+
+  private async requestTauri(id: string, frame: string, tauri: { invoke?: (command: string, args?: Record<string, unknown>) => Promise<unknown>; event?: { listen?: (name: string, callback: (event: { payload: unknown }) => void) => Promise<() => void> } }): Promise<unknown> {
+    if (!tauri.invoke || !tauri.event?.listen) throw new Error("Tauri bridge is incomplete");
+    const response = new Promise<unknown>((resolve, reject) => {
+      this.pending.set(id, { resolve, reject });
+    });
+    await tauri.invoke("send_to_sidecar", { frame });
+    return response;
+  }
+
+  private async requestBrowser(frame: string): Promise<unknown> {
+    const token = typeof document !== "undefined" ? document.documentElement.dataset.tanitToken : undefined;
+    const response = await fetch("/api", { method: "POST", headers: { "content-type": "application/json", ...(token ? { "x-tanit-token": token } : {}) }, body: frame });
+    const payload = await response.json() as { result?: unknown; error?: { message?: string } };
+    if (!response.ok || payload.error) throw new Error(payload.error?.message ?? "Host request failed");
+    return payload.result;
+  }
+
+  private dispatchEvent(event: unknown): void {
+    if (!event || typeof event !== "object") return;
+    const payload = event as { id?: unknown; result?: unknown; error?: { message?: string } };
+    if (typeof payload.id !== "string") return;
+    const pending = this.pending.get(payload.id);
+    if (!pending) return;
+    this.pending.delete(payload.id);
+    if (payload.error) pending.reject(new Error(payload.error.message ?? "Host request failed"));
+    else pending.resolve(payload.result);
   }
 }

packages/contracts/interfaces/ui/host-bridge.interface.ts

@@ -12,7 +12,7 @@ export interface IHostRequestMap {
   validate: { readonly projectRoot: string };
   check: { readonly projectRoot: string };
   sync: { readonly projectRoot: string };
-  push: { readonly projectRoot: string };
+  push: { readonly projectRoot: string; readonly workspace?: string; readonly dryRun?: boolean; readonly apiKey?: string };
   settings: undefined;
 }
 
@@ -28,7 +28,7 @@ export interface IHostResponseMap {
   validate: { readonly valid: boolean; readonly issues: ReadonlyArray<string> };
   check: { readonly passed: boolean; readonly issues: ReadonlyArray<string> };
   sync: { readonly synced: boolean };
-  push: { readonly pushed: boolean };
+  push: { readonly pushed: boolean; readonly diagnostics?: ReadonlyArray<string> };
   settings: { readonly saved: boolean };
 }
 

packages/core/session/snapshot-hash.service.ts

@@ -54,10 +54,10 @@ export function canonicalSnapshotJson(snapshot: ICanonicalSnapshot): string {
 
 export function snapshotSha256(snapshot: ICanonicalSnapshot): string {
   return createHash("sha256")
-    .update(canonicalSnapshotJson(snapshot), "utf8")
+    .update(canonicalSnapshotJson(snapshot))
     .digest("hex");
 }
 
 export function snapshotHashFromJson(json: string): string {
-  return createHash("sha256").update(json, "utf8").digest("hex");
+  return createHash("sha256").update(json).digest("hex");
 }

packages/desktop/Cargo.toml

@@ -24,6 +24,7 @@ tauri-build = { version = "2", features = [] }
 tauri = { version = "2", features = [] }
 tauri-plugin-dialog = "2"
 tauri-plugin-shell = "2"
+keyring = "3"
 
 [profile.release]
 # El binario de la ventana es un envoltorio: lo que pesa es el sidecar.

packages/desktop/src/main.rs

@@ -22,13 +22,15 @@ mod bridge;
 mod dialogs;
 mod drag_drop;
 mod sidecar;
+mod secure_storage;
 
 use std::process::Child;
 use std::sync::Mutex;
 
 use tauri::{Manager, WebviewUrl, WebviewWindowBuilder};
 
 use bridge::Bridge;
+use secure_storage::SecureStorage;
 use sidecar::spawn as spawn_sidecar;
 
 /// Posee el `Child` del sidecar para matarlo al destruirse la
@@ -40,8 +42,9 @@ fn main() {
     tauri::Builder::default()
         .plugin(tauri_plugin_dialog::init())
         .plugin(tauri_plugin_shell::init())
-        .invoke_handler(tauri::generate_handler![bridge::send_to_sidecar])
+        .invoke_handler(tauri::generate_handler![bridge::send_to_sidecar, secure_storage_save, secure_storage_retrieve, secure_storage_delete])
         .manage(Sidecar(Mutex::new(None)))
+        .manage(SecureStorage::default())
         .setup(|app| {
             // 1. Sidecar: `apisrc serve --stdio`, stdin/stdout para
             //    el bridge; stderr va a un hilo logger propio
@@ -86,6 +89,21 @@ fn main() {
         .expect("no se pudo arrancar la ventana");
 }
 
+#[tauri::command]
+fn secure_storage_save(storage: tauri::State<'_, SecureStorage>, service: String, value: String) -> Result<(), String> {
+    storage.save(service, value)
+}
+
+#[tauri::command]
+fn secure_storage_retrieve(storage: tauri::State<'_, SecureStorage>, service: String) -> Result<Option<String>, String> {
+    storage.retrieve(&service)
+}
+
+#[tauri::command]
+fn secure_storage_delete(storage: tauri::State<'_, SecureStorage>, service: String) -> Result<(), String> {
+    storage.delete(&service)
+}
+
 #[cfg(test)]
 mod tests {
     /// Documenta el reparto de módulos. Si alguien mueve un `mod`

packages/desktop/src/secure_storage.rs

@@ -1,31 +1,25 @@
 //! Native secure-storage boundary. Production wiring can replace the
 //! implementation with the platform keyring without changing the webview API.
 
-use std::collections::HashMap;
-use std::sync::Mutex;
-
-pub struct SecureStorage {
-    values: Mutex<HashMap<String, String>>,
-}
-
-impl Default for SecureStorage {
-    fn default() -> Self {
-        Self { values: Mutex::new(HashMap::new()) }
-    }
-}
+use keyring::Entry;
 
 impl SecureStorage {
     pub fn save(&self, service: String, value: String) -> Result<(), String> {
-        self.values.lock().map_err(|_| "secure storage unavailable".to_string())?.insert(service, value);
-        Ok(())
+        Entry::new("tanit", &service).map_err(|error| error.to_string())?.set_password(&value).map_err(|error| error.to_string())
     }
 
     pub fn retrieve(&self, service: &str) -> Result<Option<String>, String> {
-        Ok(self.values.lock().map_err(|_| "secure storage unavailable".to_string())?.get(service).cloned())
+        match Entry::new("tanit", service).map_err(|error| error.to_string())?.get_password() {
+            Ok(value) => Ok(Some(value)),
+            Err(keyring::Error::NoEntry) => Ok(None),
+            Err(error) => Err(error.to_string()),
+        }
     }
 
     pub fn delete(&self, service: &str) -> Result<(), String> {
-        self.values.lock().map_err(|_| "secure storage unavailable".to_string())?.remove(service);
-        Ok(())
+        match Entry::new("tanit", service).map_err(|error| error.to_string())?.delete_credential() {
+            Ok(()) | Err(keyring::Error::NoEntry) => Ok(()),
+            Err(error) => Err(error.to_string()),
+        }
     }
 }