From 0cf48ada1cdd9ef94d89597affa6884f66a35647 Mon Sep 17 00:00:00 2001
From: Dain Nilsson <dain@yubico.com>
Date: Wed, 14 Feb 2024 17:01:50 +0100
Subject: [PATCH] Windows: Require elevation in reset dialog

---
 helper/helper/fido.py                   |  3 ++-
 lib/app/views/elevate_fido_buttons.dart |  2 +-
 lib/app/views/reset_dialog.dart         | 33 +++++++++++++++++--------
 3 files changed, 26 insertions(+), 12 deletions(-)

diff --git a/helper/helper/fido.py b/helper/helper/fido.py
index 2480ea019..b78863cfe 100644
--- a/helper/helper/fido.py
+++ b/helper/helper/fido.py
@@ -126,8 +126,9 @@ def _prepare_reset_nfc(device, event, signal):
             try:
                 conn = dev.open_connection(FidoConnection)
                 if removed:
+                    conn.close()
                     sleep(1.0)  # Wait for the device to settle
-                    return conn
+                    return dev.open_connection(FidoConnection)
                 conn.close()
             except CardConnectionException:
                 pass  # Expected, ignore
diff --git a/lib/app/views/elevate_fido_buttons.dart b/lib/app/views/elevate_fido_buttons.dart
index 78257b07f..23181dc75 100644
--- a/lib/app/views/elevate_fido_buttons.dart
+++ b/lib/app/views/elevate_fido_buttons.dart
@@ -43,7 +43,7 @@ class ElevateFidoButtons extends ConsumerWidget {
                 duration: const Duration(seconds: 30));
             try {
               if (await ref.read(rpcProvider).requireValue.elevate()) {
-                ref.invalidate(rpcProvider);
+                ref.invalidate(rpcStateProvider);
               } else {
                 await ref.read(withContextProvider)((context) async =>
                     showMessage(context, l10n.s_permission_denied));
diff --git a/lib/app/views/reset_dialog.dart b/lib/app/views/reset_dialog.dart
index 3f9a15984..6e4e2a3ed 100644
--- a/lib/app/views/reset_dialog.dart
+++ b/lib/app/views/reset_dialog.dart
@@ -15,6 +15,7 @@
  */
 
 import 'dart:async';
+import 'dart:io';
 
 import 'package:flutter/material.dart';
 import 'package:flutter_gen/gen_l10n/app_localizations.dart';
@@ -25,6 +26,7 @@ import '../../app/logging.dart';
 import '../../core/models.dart';
 import '../../core/state.dart';
 import '../../desktop/models.dart';
+import '../../desktop/state.dart';
 import '../../fido/models.dart';
 import '../../fido/state.dart';
 import '../../management/models.dart';
@@ -36,6 +38,7 @@ import '../features.dart' as features;
 import '../message.dart';
 import '../models.dart';
 import '../state.dart';
+import 'elevate_fido_buttons.dart';
 import 'keys.dart';
 
 final _log = Logger('fido.views.reset_dialog');
@@ -106,7 +109,12 @@ class _ResetDialogState extends ConsumerState<ResetDialog> {
         .contains(widget.data.info.formFactor);
     final globalReset = isBio && (supported & Capability.piv.value) != 0;
     final l10n = AppLocalizations.of(context)!;
+
     double progress = _currentStep == -1 ? 0.0 : _currentStep / (_totalSteps);
+    final needsElevation = Platform.isWindows &&
+        _application == Capability.fido2 &&
+        !ref.watch(rpcStateProvider.select((state) => state.isAdmin));
+
     return ResponsiveDialog(
       title: Text(l10n.s_factory_reset),
       key: factoryResetCancel,
@@ -256,16 +264,21 @@ class _ResetDialogState extends ConsumerState<ResetDialog> {
                   .bodyMedium
                   ?.copyWith(fontWeight: FontWeight.w700),
             ),
-            Text(
-              switch (_application) {
-                Capability.oath => l10n.p_warning_disable_credentials,
-                Capability.piv => l10n.p_warning_piv_reset_desc,
-                Capability.fido2 => l10n.p_warning_disable_accounts,
-                _ => globalReset
-                    ? l10n.p_warning_global_reset_desc
-                    : l10n.p_factory_reset_desc,
-              },
-            ),
+            if (needsElevation) ...[
+              Text(l10n.p_elevated_permissions_required),
+              const ElevateFidoButtons(),
+            ] else ...[
+              Text(
+                switch (_application) {
+                  Capability.oath => l10n.p_warning_disable_credentials,
+                  Capability.piv => l10n.p_warning_piv_reset_desc,
+                  Capability.fido2 => l10n.p_warning_disable_accounts,
+                  _ => globalReset
+                      ? l10n.p_warning_global_reset_desc
+                      : l10n.p_factory_reset_desc,
+                },
+              ),
+            ],
             if (_application == Capability.fido2 && _currentStep >= 0) ...[
               Text('${l10n.s_status}: ${_getMessage()}'),
               LinearProgressIndicator(value: progress)