Merge pull request #128 from ecroteauwpi/feature/interactive-terminal-elevation

feat: add interactive Terminal elevation for managed macOS

Author: fenio

README.md

@@ -50,6 +50,18 @@ xattr -cr /Applications/anylinuxfs-gui.app
 
 Then you can open the app normally.
 
+## Administrator authentication
+
+The default **Native sudo** mode uses cached/native PAM authentication and falls back to the app's password dialog. This works for normal macOS administrator accounts.
+
+For managed Macs where an endpoint privilege manager requires an interactive terminal, open **Preferences → Administrator authentication** and select **Interactive Terminal (managed Macs)**. Admin scans and mount operations then open an owner-only temporary `.command` file in Terminal. Complete the organization's approval or justification prompt there. LUKS and BitLocker secrets are requested directly by `anylinuxfs` in Terminal; they are not placed in the generated command file or its environment.
+
+Interactive mount commands use macOS `script -q /dev/null` as a bidirectional pseudo-terminal relay and are not piped through an output-capture process. Terminal echo is disabled before the command and restored by a cleanup trap. This is required for endpoint privilege managers that place an elevated child on another pseudo-terminal, and prevents encryption secrets from being echoed or written to a handoff transcript. Output capture remains enabled only for non-secret discovery commands such as `list`.
+
+Interactive Terminal mode never opens a window for automatic background refreshes. With Admin mode enabled, click **Refresh** when disks are connected or removed. A pending mount can be cancelled from the GUI; the app terminates its Terminal handoff and requests device-specific cleanup. This mode does not bypass organizational policy: the privilege manager can still approve or deny each command.
+
+The Rust backend owns and persists the elevation setting. It cannot be changed while a privileged operation is active, so the authentication and cancellation behavior remain stable until that operation finishes.
+
 ## Screenshots
 
 <picture>

src-tauri/src/cli.rs

@@ -4,6 +4,29 @@ use std::fs;
 use std::path::{Path, PathBuf};
 use std::time::{Duration, Instant};
 use std::sync::OnceLock;
+use crate::elevation::{
+    execute_in_terminal, ElevationMode, ElevationState, TerminalExecutionError,
+    TerminalInteraction,
+};
+
+#[derive(Debug, Clone)]
+pub enum CommandExecutionError {
+    InteractionRequired,
+    Cancelled,
+    TimedOut,
+    Failed(String),
+}
+
+impl CommandExecutionError {
+    pub fn message(&self) -> String {
+        match self {
+            Self::InteractionRequired => "ALFS_SILENT_AUTH_EXPIRED".to_string(),
+            Self::Cancelled => "Interactive Terminal operation was cancelled".to_string(),
+            Self::TimedOut => "Interactive Terminal operation timed out".to_string(),
+            Self::Failed(message) => message.clone(),
+        }
+    }
+}
 
 /// Sanitize error output to avoid exposing sensitive system details
 /// Logs the full error for debugging but returns a user-friendly message
@@ -22,6 +45,9 @@ fn sanitize_error(stdout: &str, stderr: &str) -> String {
     if combined.contains("Permission denied") {
         return "Permission denied - try running with administrator privileges".to_string();
     }
+    if combined.contains("Execution blocked") || combined.contains("does not have Admin rights") {
+        return "Administrator elevation was blocked by system policy".to_string();
+    }
     if combined.contains("Device busy") || combined.contains("resource busy") {
         return "Device is busy - close any applications using it and try again".to_string();
     }
@@ -172,6 +198,54 @@ pub fn execute_command(args: &[&str], needs_sudo: bool, passphrase: Option<&str>
     }
 }
 
+/// Execute an anylinuxfs command using the Rust-owned elevation policy.
+pub fn execute_command_with_elevation(
+    args: &[&str],
+    needs_sudo: bool,
+    passphrase: Option<&str>,
+    silent: bool,
+    elevation_mode: ElevationMode,
+    elevation_state: &ElevationState,
+    terminal_interaction: TerminalInteraction,
+) -> Result<String, CommandExecutionError> {
+    if needs_sudo {
+        match elevation_mode {
+            ElevationMode::Native => execute_with_sudo(args, passphrase, silent)
+                .map_err(|error| {
+                    if error == "ALFS_SILENT_AUTH_EXPIRED" {
+                        CommandExecutionError::InteractionRequired
+                    } else {
+                        CommandExecutionError::Failed(error)
+                    }
+                }),
+            ElevationMode::InteractiveTerminal => execute_in_terminal(
+                elevation_state,
+                get_anylinuxfs_path().ok_or_else(|| {
+                    CommandExecutionError::Failed(
+                        "anylinuxfs CLI not found in PATH or standard locations".to_string(),
+                    )
+                })?,
+                args,
+                silent,
+                terminal_interaction,
+            )
+            .map_err(|error| match error {
+                TerminalExecutionError::InteractionRequired => {
+                    CommandExecutionError::InteractionRequired
+                }
+                TerminalExecutionError::Cancelled => CommandExecutionError::Cancelled,
+                TerminalExecutionError::TimedOut => CommandExecutionError::TimedOut,
+                TerminalExecutionError::CommandFailed { output, .. } if !output.is_empty() => {
+                    CommandExecutionError::Failed(sanitize_error(&output, ""))
+                }
+                other => CommandExecutionError::Failed(other.to_string()),
+            }),
+        }
+    } else {
+        execute_direct(args, passphrase).map_err(CommandExecutionError::Failed)
+    }
+}
+
 fn execute_direct(args: &[&str], passphrase: Option<&str>) -> Result<String, String> {
     let cli_path = get_anylinuxfs_path()
         .ok_or_else(|| "anylinuxfs CLI not found in PATH or standard locations".to_string())?;
@@ -391,3 +465,17 @@ osascript -e 'Tell application "System Events" to display dialog "anylinuxfs req
 
     Ok(path.to_string_lossy().to_string())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn endpoint_privilege_denial_has_a_specific_error() {
+        let message = sanitize_error(
+            "Execution blocked: user does not have Admin rights",
+            "",
+        );
+        assert_eq!(message, "Administrator elevation was blocked by system policy");
+    }
+}