Skip to content

fix(network): pre-fill saved VPN password from the GetSecrets payload #1472

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lkramer wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix(network): pre-fill saved VPN password from the GetSecrets payload #1472

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
61 changes: 60 additions & 1 deletion cosmic-applet-network/src/app.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -297,6 +297,8 @@ pub enum NmAgentEvent {
connection_id: String,
setting: AgentSetting,
responder: SecretResponderHandle,
/// Secrets NM already holds (system-owned), for pre-fill.
existing_secrets: HashMap<String, String>,
},
CancelGetSecrets,
Failed(String),
Expand Down Expand Up @@ -985,9 +987,18 @@ fn secret_request_to_event(req: SecretRequest) -> NmAgentEvent {
connection_id: req.connection_id,
setting,
responder: Arc::new(AsyncMutex::new(Some(req.responder))),
existing_secrets: req.existing_secrets,
}
}

/// Pick a VPN secret from NM's payload: a hinted key first, else `"password"`.
fn pick_secret(src: &HashMap<String, String>, keys: &[String]) -> Option<String> {

@cachebag cachebag Jul 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Small nit pick if you don't mind: if a hinted key exists but its value is empty, this returns that empty value and filters to None without trying the "password" fallback. Could this skip a valid saved password when NM includes an empty hinted secret plus a populated fallback key?

Maybe filter empties before selecting:

keys.iter()
    .filter_map(|k| src.get(k).filter(|s| !s.is_empty()))
    .next()
    .or_else(|| src.get("password").filter(|s| !s.is_empty()))
    .cloned()

@lkramer lkramer Jul 11, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, nice spot! I updated my code.

I don't know what the convention is, the code seems lightweight on unit tests, but to me it made sense to add some for this function to confirm your edge case was solved, so I did. Let me know if you want me to remove them.

keys.iter()
.find_map(|k| src.get(k).filter(|s| !s.is_empty()))
.or_else(|| src.get("password").filter(|s| !s.is_empty()))
.cloned()
}

/// Reply with [`NoSecrets`](nmrs::agent::SecretResponder::no_secrets) to free
/// NetworkManager when the applet decides not to use the responder. Dropping
/// it would also auto-reply, but doing it explicitly keeps the log clean.
Expand Down Expand Up @@ -1460,6 +1471,7 @@ impl cosmic::Application for CosmicNetworkApplet {
connection_id,
setting,
responder,
existing_secrets,
} => {
let description = (!connection_id.is_empty()).then_some(connection_id);
let known_vpn = self
Expand Down Expand Up @@ -1503,10 +1515,15 @@ impl cosmic::Application for CosmicNetworkApplet {
AgentSetting::Vpn { secret_keys } => secret_keys.clone(),
_ => Vec::new(),
};
// Pre-fill with the saved secret NM sends in the request
// (system-owned secrets are included in the payload).
let password = pick_secret(&existing_secrets, &secret_keys)
.map(SecureString::from)
.unwrap_or_else(|| SecureString::from(String::new()));
self.nm_state.requested_vpn = Some(RequestedVpn {
uuid: connection_uuid.into(),
description,
password: SecureString::from(String::new()),
password,
password_hidden: true,
responder: responder.clone(),
secret_keys,
Expand Down Expand Up @@ -2255,3 +2272,45 @@ fn active_conn_hw_address(conn: &ActiveConnectionInfo) -> HwAddress {
ActiveConnectionInfo::Vpn { .. } => HwAddress::default(),
}
}

#[cfg(test)]
mod tests {
use super::*;

fn secrets(pairs: &[(&str, &str)]) -> HashMap<String, String> {
pairs
.iter()
.map(|(k, v)| ((*k).to_owned(), (*v).to_owned()))
.collect()
}

#[test]
fn hinted_key_is_preferred() {
let s = secrets(&[("password", "pw"), ("otp", "123")]);
assert_eq!(pick_secret(&s, &["otp".into()]).as_deref(), Some("123"));
}

#[test]
fn empty_hint_list_falls_back_to_password() {
let s = secrets(&[("password", "pw")]);
assert_eq!(pick_secret(&s, &[]).as_deref(), Some("pw"));
}

#[test]
fn missing_hinted_key_falls_back_to_password() {
let s = secrets(&[("password", "pw")]);
assert_eq!(pick_secret(&s, &["absent".into()]).as_deref(), Some("pw"));
}

#[test]
fn empty_hinted_value_does_not_shadow_populated_fallback() {
let s = secrets(&[("otp", ""), ("password", "pw")]);
assert_eq!(pick_secret(&s, &["otp".into()]).as_deref(), Some("pw"));
}

#[test]
fn nothing_usable_returns_none() {
let s = secrets(&[("password", "")]);
assert_eq!(pick_secret(&s, &["otp".into()]), None);
}
}
Loading