From be3ec7e84121cd83416d0427059ca107bc1d5506 Mon Sep 17 00:00:00 2001
From: Mike Sawka <mike@commandline.dev>
Date: Fri, 1 Nov 2024 12:17:19 -0700
Subject: [PATCH] another try at audio permissions (and more) for #1086 (#1192)

the permissions look scary, but the user still needs to grant them.  this just allows the app to ask.  this permission set now matches the entitlements in iTerm and other popular terminal programs (before we were too restrictive)
---
 build/entitlements.mac.plist | 27 +++++++++++++++++++++++++++
 electron-builder.config.cjs  | 15 +++++++++++++--
 emain/menu.ts                | 11 -----------
 emain/preload.ts             | 12 ------------
 4 files changed, 40 insertions(+), 25 deletions(-)
 create mode 100644 build/entitlements.mac.plist

diff --git a/build/entitlements.mac.plist b/build/entitlements.mac.plist
new file mode 100644
index 000000000..c207a0b5c
--- /dev/null
+++ b/build/entitlements.mac.plist
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <!-- required for electron -->
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+
+    <!-- we add the following entitlements so that *CLI* applications can request/use these features.  this matches iTerm's permission set -->
+    <key>com.apple.security.device.audio-input</key>
+    <true/>
+    <key>com.apple.security.device.camera</key>
+    <true/>
+    <key>com.apple.security.personal-information.addressbook</key>
+    <true/>
+    <key>com.apple.security.personal-information.calendars</key>
+    <true/>
+    <key>com.apple.security.personal-information.location</key>
+    <true/>
+    <key>com.apple.security.personal-information.photos-library</key>
+    <true/>
+</dict>
+</plist>
diff --git a/electron-builder.config.cjs b/electron-builder.config.cjs
index e9daf3eda..5017ba87c 100644
--- a/electron-builder.config.cjs
+++ b/electron-builder.config.cjs
@@ -53,9 +53,20 @@ const config = {
         minimumSystemVersion: "10.15.0",
         mergeASARs: true,
         singleArchFiles: "dist/bin/wavesrv.*",
+        entitlements: "build/entitlements.mac.plist",
+        entitlementsInherit: "build/entitlements.mac.plist",
         extendInfo: {
-            NSMicrophoneUsageDescription:
-                "This app requires microphone access if you'd like to enable audio input for terminal applications.",
+            NSContactsUsageDescription: "A CLI application running in Wave wants to use your contacts.",
+            NSRemindersUsageDescription: "A CLI application running in Wave wants to use your reminders.",
+            NSLocationWhenInUseUsageDescription:
+                "A CLI application running in Wave wants to use your location information while active.",
+            NSLocationAlwaysUsageDescription:
+                "A CLI application running in Wave wants to use your location information, even in the background.",
+            NSCameraUsageDescription: "A CLI application running in Wave wants to use the camera.",
+            NSMicrophoneUsageDescription: "A CLI application running in Wave wants to use your microphone.",
+            NSCalendarsUsageDescription: "A CLI application running in Wave wants to use Calendar data.",
+            NSLocationUsageDescription: "A CLI application running in Wave wants to use your location information.",
+            NSAppleEventsUsageDescription: "A CLI application running in Wave wants to use AppleScript.",
         },
     },
     linux: {
diff --git a/emain/menu.ts b/emain/menu.ts
index a0f0c6c0e..f5bfe6c51 100644
--- a/emain/menu.ts
+++ b/emain/menu.ts
@@ -78,17 +78,6 @@ function getAppMenu(callbacks: AppMenuCallbacks): Electron.Menu {
             }
         );
     }
-    appMenu.push({
-        label: "Permissions",
-        submenu: [
-            {
-                label: "Request Audio Access",
-                click: (_, window) => {
-                    getWindowWebContents(window)?.send("request-audio-access");
-                },
-            },
-        ],
-    });
     appMenu.push({
         role: "quit",
     });
diff --git a/emain/preload.ts b/emain/preload.ts
index 47864f1e8..966b121b2 100644
--- a/emain/preload.ts
+++ b/emain/preload.ts
@@ -61,15 +61,3 @@ ipcRenderer.on("webcontentsid-from-blockid", (e, blockId, responseCh) => {
     const wcId = webviewElem?.dataset?.webcontentsid;
     ipcRenderer.send(responseCh, wcId);
 });
-
-ipcRenderer.on("request-audio-access", (e) => {
-    ipcRenderer.send("fe-log", "Requesting audio access");
-    navigator.mediaDevices
-        .getUserMedia({ audio: true })
-        .then(() => {
-            ipcRenderer.send("fe-log", "Audio access granted");
-        })
-        .catch((err) => {
-            ipcRenderer.send("fe-log", "Audio access denied: " + err);
-        });
-});