Route dev-cert install through an elevated window instead of failing (#34)#63
Open
chiaramooney wants to merge 4 commits into
Open
Route dev-cert install through an elevated window instead of failing (#34)#63chiaramooney wants to merge 4 commits into
chiaramooney wants to merge 4 commits into
Conversation
Installing a development certificate trusts it in the machine store, which requires administrator rights. VS Code isn't elevated by default and cannot create an elevated integrated terminal, so `cert generate --install` and `cert install` printed a red "Access denied" failure even though the cert was generated — a scary, misleading first-run experience. - Detect whether VS Code is elevated (WindowsPrincipal check). When elevated, run the install in the normal terminal as before. - When not elevated, launch the command in a separate UAC-elevated PowerShell window via `Start-Process -Verb RunAs`, and show an info message so the user knows to approve the prompt. The elevated shell is pointed back at the working directory with `Set-Location` (RunAs otherwise starts in System32, which would break `cert generate` publisher inference and misplace devcert.pfx). - Default the Generate Certificate quick pick to "Generate only" so users opt into the admin step instead of hitting it by surprise. - Extract `buildElevatedTerminalCommand` into winapp-cli-utils with unit tests covering escaping, the RunAs verb, and the working-directory fix. - Update README command table and troubleshooting notes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5ce7415c-8966-43ec-ad27-59a68e7ed74b
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5ce7415c-8966-43ec-ad27-59a68e7ed74b
…arify launcher terminal (#34) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5ce7415c-8966-43ec-ad27-59a68e7ed74b
… probe and launcher terminal (#34) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5ce7415c-8966-43ec-ad27-59a68e7ed74b
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #34.
Investigation summary
The "Generate and install a development certificate?" flow defaulted to installing, and
winapp cert installtrusts the cert in the machine store, which requires admin. VS Code isn't elevated by default, and there is no VS Code API to create an elevated integrated terminal (confirmed — it's disallowed by design for security). So the install failed with a redAccess deniedeven though the certificate was successfully generated.The bundled CLI also has no CurrentUser install option (
cert installhelp: "Trust a certificate on this machine (requires admin)"), so installing to a non-elevated store isn't possible from the extension today.Fix
Per discussion, the behavior is now elevation-aware:
Start-Process -Verb RunAs, with an info message telling the user to approve the prompt. This replaces the guaranteed "Access denied" failure with a working install path.Applies to WinApp: Generate Certificate and WinApp: Install Certificate.
Implementation notes
buildElevatedTerminalCommandis extracted intowinapp-cli-utils.tswith unit tests (shell-escape.test.ts) covering quote escaping, the RunAs verb, and the working-directory handling.System32; the elevated shell is pointed back at the project directory withSet-Location(notStart-Process -WorkingDirectory, which is ignored with-Verbon Windows PowerShell 5.1) socert generatestill infers the publisher from the manifest and writesdevcert.pfxin the right place.Out of scope (flagging)
The Create MSIX Package command's
--install-certoption has the same elevation trap but is a separate command surface not named in the issue. Left untouched to keep this PR scoped to #34 — happy to do it as a follow-up.Testing
npm run compile-tsc— cleannpm run lint— 0 errors (8 pre-existing warnings)npm run test:unit— passing (11 in shell-escape.test.ts, incl. new elevation-command tests)npm run package— build complete