[WIP] Encryption for secure values (#183)

src-tauri/.gitignore

@@ -4,3 +4,8 @@ target/
 
 vendored/*
 !vendored/plugins
+
+gen/*
+
+**/permissions/autogenerated
+**/permissions/schemas

src-tauri/Cargo.toml

@@ -1,9 +1,11 @@
 [workspace]
 members = [
+    "yaak-crypto",
     "yaak-git",
     "yaak-grpc",
     "yaak-http",
     "yaak-license",
+    "yaak-mac-window",
     "yaak-models",
     "yaak-plugins",
     "yaak-sse",
@@ -31,12 +33,7 @@ strip = true  # Automatically strip symbols from the binary.
 cargo-clippy = []
 
 [build-dependencies]
-tauri-build = { version = "2.1.0", features = [] }
-
-[target.'cfg(target_os = "macos")'.dependencies]
-hex_color = "3.0.0"
-objc = "0.2.7"
-cocoa = "0.26.0"
+tauri-build = { version = "2.1.1", features = [] }
 
 [target.'cfg(target_os = "linux")'.dependencies]
 openssl-sys = { version = "0.9.105", features = ["vendored"] } # For Ubuntu installation to work
@@ -68,14 +65,16 @@ tauri-plugin-single-instance = "2.2.2"
 tauri-plugin-updater = "2.6.1"
 tauri-plugin-window-state = "2.2.1"
 thiserror = { workspace = true }
-tokio = { version = "1.43.0", features = ["sync"] }
+tokio = { workspace = true, features = ["sync"] }
 tokio-stream = "0.1.17"
 uuid = "1.12.1"
 yaak-common = { workspace = true }
+yaak-crypto = { workspace = true }
 yaak-git = { path = "yaak-git" }
 yaak-grpc = { path = "yaak-grpc" }
 yaak-http = { workspace = true }
 yaak-license = { path = "yaak-license" }
+yaak-mac-window = { path = "yaak-mac-window" }
 yaak-models = { workspace = true }
 yaak-plugins = { workspace = true }
 yaak-sse = { workspace = true }
@@ -84,14 +83,15 @@ yaak-templates = { workspace = true }
 yaak-ws = { path = "yaak-ws" }
 
 [workspace.dependencies]
-reqwest = "0.12.12"
-serde = "1.0.215"
-serde_json = "1.0.132"
-tauri = "2.4.0"
-tauri-plugin = "2.1.0"
-tauri-plugin-shell = "2.2.0"
-thiserror = "2.0.3"
-ts-rs = "10.0.0"
+reqwest = "0.12.15"
+serde = "1.0.219"
+serde_json = "1.0.140"
+tauri = "2.4.1"
+tauri-plugin = "2.1.1"
+tauri-plugin-shell = "2.2.1"
+tokio = "1.44.2"
+thiserror = "2.0.12"
+ts-rs = "10.1.0"
 yaak-common = { path = "yaak-common" }
 yaak-http = { path = "yaak-http" }
 yaak-models = { path = "yaak-models" }
@@ -99,3 +99,4 @@ yaak-plugins = { path = "yaak-plugins" }
 yaak-sse = { path = "yaak-sse" }
 yaak-sync = { path = "yaak-sync" }
 yaak-templates = { path = "yaak-templates" }
+yaak-crypto = { path = "yaak-crypto" }

src-tauri/capabilities/capabilities.json

@@ -50,8 +50,10 @@
     "opener:allow-open-url",
     "opener:allow-reveal-item-in-dir",
     "shell:allow-open",
+    "yaak-crypto:default",
     "yaak-git:default",
     "yaak-license:default",
+    "yaak-mac-window:default",
     "yaak-models:default",
     "yaak-sync:default",
     "yaak-ws:default"

src-tauri/gen/schemas/capabilities.json

@@ -1 +0,0 @@
-{"main":{"identifier":"main","description":"Main permissions","local":true,"windows":["*"],"permissions":["core:event:allow-emit","core:event:allow-listen","core:event:allow-unlisten","os:allow-os-type","clipboard-manager:allow-clear","clipboard-manager:allow-write-text","clipboard-manager:allow-read-text","dialog:allow-open","dialog:allow-save","fs:allow-read-dir","fs:allow-read-file","fs:allow-read-text-file",{"identifier":"fs:scope","allow":[{"path":"$APPDATA"},{"path":"$APPDATA/**"}]},"clipboard-manager:allow-read-text","clipboard-manager:allow-write-text","core:webview:allow-set-webview-zoom","core:window:allow-close","core:window:allow-internal-toggle-maximize","core:window:allow-is-fullscreen","core:window:allow-is-maximized","core:window:allow-maximize","core:window:allow-minimize","core:window:allow-set-decorations","core:window:allow-set-title","core:window:allow-show","core:window:allow-start-dragging","core:window:allow-theme","core:window:allow-unmaximize","opener:allow-default-urls","opener:allow-open-path","opener:allow-open-url","opener:allow-reveal-item-in-dir","shell:allow-open","yaak-git:default","yaak-license:default","yaak-models:default","yaak-sync:default","yaak-ws:default"]}}

src-tauri/migrations/20250401122407_encrypted-key.sql

@@ -0,0 +1 @@
+ALTER TABLE workspace_metas ADD COLUMN encryption_key TEXT NULL DEFAULT NULL;

src-tauri/migrations/20250402144842_encryption-key-challenge.sql

@@ -0,0 +1 @@
+ALTER TABLE workspaces ADD COLUMN encryption_key_challenge TEXT NULL;

src-tauri/src/commands.rs

@@ -0,0 +1,40 @@
+use crate::error::Result;
+use tauri::{command, AppHandle, Manager, Runtime, WebviewWindow};
+use tauri_plugin_dialog::{DialogExt, MessageDialogKind};
+use yaak_crypto::manager::EncryptionManagerExt;
+use yaak_plugins::events::PluginWindowContext;
+use yaak_plugins::native_template_functions::{decrypt_secure_template_function, encrypt_secure_template_function};
+
+#[command]
+pub(crate) async fn cmd_show_workspace_key<R: Runtime>(
+    window: WebviewWindow<R>,
+    workspace_id: &str,
+) -> Result<()> {
+    let key = window.crypto().reveal_workspace_key(workspace_id)?;
+    window
+        .dialog()
+        .message(format!("Your workspace key is \n\n{}", key))
+        .kind(MessageDialogKind::Info)
+        .show(|_v| {});
+    Ok(())
+}
+
+#[command]
+pub(crate) async fn cmd_decrypt_template<R: Runtime>(
+    window: WebviewWindow<R>,
+    template: &str,
+) -> Result<String> {
+    let app_handle = window.app_handle();
+    let window_context = &PluginWindowContext::new(&window);
+    Ok(decrypt_secure_template_function(&app_handle, window_context, template)?)
+}
+
+#[command]
+pub(crate) async fn cmd_secure_template<R: Runtime>(
+    app_handle: AppHandle<R>,
+    window: WebviewWindow<R>,
+    template: &str,
+) -> Result<String> {
+    let window_context = &PluginWindowContext::new(&window);
+    Ok(encrypt_secure_template_function(&app_handle, window_context, template)?)
+}

src-tauri/src/error.rs

@@ -1,3 +1,4 @@
+use std::io;
 use serde::{Serialize, Serializer};
 use thiserror::Error;
 
@@ -11,6 +12,9 @@ pub enum Error {
 
     #[error(transparent)]
     SyncError(#[from] yaak_sync::error::Error),
+    
+    #[error(transparent)]
+    CryptoError(#[from] yaak_crypto::error::Error),
 
     #[error(transparent)]
     GitError(#[from] yaak_git::error::Error),
@@ -26,6 +30,18 @@ pub enum Error {
 
     #[error("Updater error: {0}")]
     UpdaterError(#[from] tauri_plugin_updater::Error),
+    
+    #[error("JSON error: {0}")]
+    JsonError(#[from] serde_json::error::Error),
+    
+    #[error("Tauri error: {0}")]
+    TauriError(#[from] tauri::Error),
+    
+    #[error("Event source error: {0}")]
+    EventSourceError(#[from] eventsource_client::Error),
+    
+    #[error("I/O error: {0}")]
+    IOError(#[from] io::Error),
 
     #[error("Request error: {0}")]
     RequestError(#[from] reqwest::Error),

src-tauri/src/http_request.rs

@@ -31,7 +31,7 @@ use yaak_models::models::{
 use yaak_models::query_manager::QueryManagerExt;
 use yaak_models::util::UpdateSource;
 use yaak_plugins::events::{
-    CallHttpAuthenticationRequest, HttpHeader, RenderPurpose, WindowContext,
+    CallHttpAuthenticationRequest, HttpHeader, PluginWindowContext, RenderPurpose,
 };
 use yaak_plugins::manager::PluginManager;
 use yaak_plugins::template_callback::PluginTemplateCallback;
@@ -60,7 +60,7 @@ pub async fn send_http_request<R: Runtime>(
 
     let cb = PluginTemplateCallback::new(
         window.app_handle(),
-        &WindowContext::from_window(window),
+        &PluginWindowContext::new(window),
         RenderPurpose::Send,
     );
     let update_source = UpdateSource::from_window(window);
@@ -383,7 +383,7 @@ pub async fn send_http_request<R: Runtime>(
                                 };
                             }
 
-                            // Set file path if not empty
+                            // Set file path if it is not empty
                             if !file_path.is_empty() {
                                 let filename = PathBuf::from(file_path)
                                     .file_name()
@@ -442,7 +442,7 @@ pub async fn send_http_request<R: Runtime>(
                 })
                 .collect(),
         };
-        let auth_result = plugin_manager.call_http_authentication(window, &auth_name, req).await;
+        let auth_result = plugin_manager.call_http_authentication(&window, &auth_name, req).await;
         let plugin_result = match auth_result {
             Ok(r) => r,
             Err(e) => {

src-tauri/src/lib.rs

@@ -1,6 +1,4 @@
 extern crate core;
-#[cfg(target_os = "macos")]
-extern crate objc;
 use crate::encoding::read_response_body;
 use crate::error::Error::GenericError;
 use crate::grpc::metadata_to_map;
@@ -43,14 +41,15 @@ use yaak_plugins::events::{
     BootResponse, CallHttpAuthenticationRequest, CallHttpRequestActionRequest, FilterResponse,
     GetHttpAuthenticationConfigResponse, GetHttpAuthenticationSummaryResponse,
     GetHttpRequestActionsResponse, GetTemplateFunctionsResponse, HttpHeader, InternalEvent,
-    InternalEventPayload, JsonPrimitive, RenderPurpose, WindowContext,
+    InternalEventPayload, JsonPrimitive, PluginWindowContext, RenderPurpose,
 };
 use yaak_plugins::manager::PluginManager;
 use yaak_plugins::template_callback::PluginTemplateCallback;
 use yaak_sse::sse::ServerSentEvent;
 use yaak_templates::format::format_json;
-use yaak_templates::{Parser, Tokens};
+use yaak_templates::{Tokens, transform_args};
 
+mod commands;
 mod encoding;
 mod error;
 mod grpc;
@@ -59,8 +58,6 @@ mod http_request;
 mod notifications;
 mod plugin_events;
 mod render;
-#[cfg(target_os = "macos")]
-mod tauri_plugin_mac_window;
 mod updates;
 mod uri_scheme;
 mod window;
@@ -77,9 +74,9 @@ struct AppMetaData {
 }
 
 #[tauri::command]
-async fn cmd_metadata(app_handle: AppHandle) -> Result<AppMetaData, ()> {
-    let app_data_dir = app_handle.path().app_data_dir().unwrap();
-    let app_log_dir = app_handle.path().app_log_dir().unwrap();
+async fn cmd_metadata(app_handle: AppHandle) -> YaakResult<AppMetaData> {
+    let app_data_dir = app_handle.path().app_data_dir()?;
+    let app_log_dir = app_handle.path().app_log_dir()?;
     Ok(AppMetaData {
         is_dev: is_dev(),
         version: app_handle.package_info().version.to_string(),
@@ -90,13 +87,18 @@ async fn cmd_metadata(app_handle: AppHandle) -> Result<AppMetaData, ()> {
 }
 
 #[tauri::command]
-async fn cmd_parse_template(template: &str) -> YaakResult<Tokens> {
-    Ok(Parser::new(template).parse()?)
-}
-
-#[tauri::command]
-async fn cmd_template_tokens_to_string(tokens: Tokens) -> Result<String, String> {
-    Ok(tokens.to_string())
+async fn cmd_template_tokens_to_string<R: Runtime>(
+    window: WebviewWindow<R>,
+    app_handle: AppHandle<R>,
+    tokens: Tokens,
+) -> YaakResult<String> {
+    let cb = PluginTemplateCallback::new(
+        &app_handle,
+        &PluginWindowContext::new(&window),
+        RenderPurpose::Preview,
+    );
+    let new_tokens = transform_args(tokens, &cb)?;
+    Ok(new_tokens.to_string())
 }
 
 #[tauri::command]
@@ -118,7 +120,7 @@ async fn cmd_render_template<R: Runtime>(
         environment.as_ref(),
         &PluginTemplateCallback::new(
             &app_handle,
-            &WindowContext::from_window(&window),
+            &PluginWindowContext::new(&window),
             RenderPurpose::Preview,
         ),
     )
@@ -131,8 +133,8 @@ async fn cmd_dismiss_notification<R: Runtime>(
     window: WebviewWindow<R>,
     notification_id: &str,
     yaak_notifier: State<'_, Mutex<YaakNotifier>>,
-) -> Result<(), String> {
-    yaak_notifier.lock().await.seen(&window, notification_id).await
+) -> YaakResult<()> {
+    Ok(yaak_notifier.lock().await.seen(&window, notification_id).await?)
 }
 
 #[tauri::command]
@@ -157,11 +159,11 @@ async fn cmd_grpc_reflect<R: Runtime>(
         environment.as_ref(),
         &PluginTemplateCallback::new(
             &app_handle,
-            &WindowContext::from_window(&window),
+            &PluginWindowContext::new(&window),
             RenderPurpose::Send,
         ),
     )
-        .await?;
+    .await?;
 
     let uri = safe_uri(&req.url);
 
@@ -200,7 +202,7 @@ async fn cmd_grpc_go<R: Runtime>(
         environment.as_ref(),
         &PluginTemplateCallback::new(
             &app_handle,
-            &WindowContext::from_window(&window),
+            &PluginWindowContext::new(&window),
             RenderPurpose::Send,
         ),
     )
@@ -356,7 +358,7 @@ async fn cmd_grpc_go<R: Runtime>(
                                 environment.as_ref(),
                                 &PluginTemplateCallback::new(
                                     &app_handle,
-                                    &WindowContext::from_window(&window),
+                                    &PluginWindowContext::new(&window),
                                     RenderPurpose::Send,
                                 ),
                             )
@@ -425,7 +427,7 @@ async fn cmd_grpc_go<R: Runtime>(
             environment.as_ref(),
             &PluginTemplateCallback::new(
                 &app_handle,
-                &WindowContext::from_window(&window),
+                &PluginWindowContext::new(&window),
                 RenderPurpose::Send,
             ),
         )
@@ -742,7 +744,7 @@ async fn cmd_send_ephemeral_request<R: Runtime>(
 }
 
 #[tauri::command]
-async fn cmd_format_json(text: &str) -> Result<String, String> {
+async fn cmd_format_json(text: &str) -> YaakResult<String> {
     Ok(format_json(text, "  "))
 }
 
@@ -777,10 +779,10 @@ async fn cmd_filter_response<R: Runtime>(
 }
 
 #[tauri::command]
-async fn cmd_get_sse_events(file_path: &str) -> Result<Vec<ServerSentEvent>, String> {
-    let body = fs::read(file_path).map_err(|e| e.to_string())?;
+async fn cmd_get_sse_events(file_path: &str) -> YaakResult<Vec<ServerSentEvent>> {
+    let body = fs::read(file_path)?;
     let mut event_parser = EventParser::new();
-    event_parser.process_bytes(body.into()).map_err(|e| e.to_string())?;
+    event_parser.process_bytes(body.into())?;
 
     let mut events = Vec::new();
     while let Some(e) = event_parser.get_event() {
@@ -897,27 +899,24 @@ async fn cmd_import_data<R: Runtime>(
 async fn cmd_http_request_actions<R: Runtime>(
     window: WebviewWindow<R>,
     plugin_manager: State<'_, PluginManager>,
-) -> Result<Vec<GetHttpRequestActionsResponse>, String> {
-    plugin_manager.get_http_request_actions(&window).await.map_err(|e| e.to_string())
+) -> YaakResult<Vec<GetHttpRequestActionsResponse>> {
+    Ok(plugin_manager.get_http_request_actions(&window).await?)
 }
 
 #[tauri::command]
 async fn cmd_template_functions<R: Runtime>(
     window: WebviewWindow<R>,
     plugin_manager: State<'_, PluginManager>,
-) -> Result<Vec<GetTemplateFunctionsResponse>, String> {
-    plugin_manager.get_template_functions(&window).await.map_err(|e| e.to_string())
+) -> YaakResult<Vec<GetTemplateFunctionsResponse>> {
+    Ok(plugin_manager.get_template_functions(&window).await?)
 }
 
 #[tauri::command]
 async fn cmd_get_http_authentication_summaries<R: Runtime>(
     window: WebviewWindow<R>,
     plugin_manager: State<'_, PluginManager>,
-) -> Result<Vec<GetHttpAuthenticationSummaryResponse>, String> {
-    let results = plugin_manager
-        .get_http_authentication_summaries(&window)
-        .await
-        .map_err(|e| e.to_string())?;
+) -> YaakResult<Vec<GetHttpAuthenticationSummaryResponse>> {
+    let results = plugin_manager.get_http_authentication_summaries(&window).await?;
     Ok(results.into_iter().map(|(_, a)| a).collect())
 }
 
@@ -928,11 +927,10 @@ async fn cmd_get_http_authentication_config<R: Runtime>(
     auth_name: &str,
     values: HashMap<String, JsonPrimitive>,
     request_id: &str,
-) -> Result<GetHttpAuthenticationConfigResponse, String> {
-    plugin_manager
+) -> YaakResult<GetHttpAuthenticationConfigResponse> {
+    Ok(plugin_manager
         .get_http_authentication_config(&window, auth_name, values, request_id)
-        .await
-        .map_err(|e| e.to_string())
+        .await?)
 }
 
 #[tauri::command]
@@ -940,8 +938,8 @@ async fn cmd_call_http_request_action<R: Runtime>(
     window: WebviewWindow<R>,
     req: CallHttpRequestActionRequest,
     plugin_manager: State<'_, PluginManager>,
-) -> Result<(), String> {
-    plugin_manager.call_http_request_action(&window, req).await.map_err(|e| e.to_string())
+) -> YaakResult<()> {
+    Ok(plugin_manager.call_http_request_action(&window, req).await?)
 }
 
 #[tauri::command]
@@ -952,11 +950,10 @@ async fn cmd_call_http_authentication_action<R: Runtime>(
     action_index: i32,
     values: HashMap<String, JsonPrimitive>,
     request_id: &str,
-) -> Result<(), String> {
-    plugin_manager
+) -> YaakResult<()> {
+    Ok(plugin_manager
         .call_http_authentication_action(&window, auth_name, action_index, values, request_id)
-        .await
-        .map_err(|e| e.to_string())
+        .await?)
 }
 
 #[tauri::command]
@@ -965,18 +962,20 @@ async fn cmd_curl_to_request<R: Runtime>(
     command: &str,
     plugin_manager: State<'_, PluginManager>,
     workspace_id: &str,
-) -> Result<HttpRequest, String> {
-    let import_result =
-        { plugin_manager.import_data(&window, command).await.map_err(|e| e.to_string())? };
+) -> YaakResult<HttpRequest> {
+    let import_result = plugin_manager.import_data(&window, command).await?;
 
-    import_result.resources.http_requests.get(0).ok_or("No curl command found".to_string()).map(
-        |r| {
+    Ok(import_result
+        .resources
+        .http_requests
+        .get(0)
+        .ok_or(GenericError("No curl command found".to_string()))
+        .map(|r| {
             let mut request = r.clone();
             request.workspace_id = workspace_id.into();
             request.id = "".to_string();
             request
-        },
-    )
+        })?)
 }
 
 #[tauri::command]
@@ -985,11 +984,9 @@ async fn cmd_export_data<R: Runtime>(
     export_path: &str,
     workspace_ids: Vec<&str>,
     include_environments: bool,
-) -> Result<(), String> {
+) -> YaakResult<()> {
     let export_data =
-        get_workspace_export_resources(&app_handle, workspace_ids, include_environments)
-            .await
-            .map_err(|e| e.to_string())?;
+        get_workspace_export_resources(&app_handle, workspace_ids, include_environments).await?;
     let f = File::options()
         .create(true)
         .truncate(true)
@@ -998,7 +995,7 @@ async fn cmd_export_data<R: Runtime>(
         .expect("Unable to create file");
 
     serde_json::to_writer_pretty(&f, &export_data)
-        .map_err(|e| e.to_string())
+        .map_err(|e| GenericError(e.to_string()))
         .expect("Failed to write");
 
     f.sync_all().expect("Failed to sync");
@@ -1092,9 +1089,7 @@ async fn cmd_install_plugin<R: Runtime>(
     app_handle: AppHandle<R>,
     window: WebviewWindow<R>,
 ) -> YaakResult<Plugin> {
-    plugin_manager
-        .add_plugin_by_dir(&WindowContext::from_window(&window), &directory, true)
-        .await?;
+    plugin_manager.add_plugin_by_dir(&PluginWindowContext::new(&window), &directory, true).await?;
 
     Ok(app_handle.db().upsert_plugin(
         &Plugin {
@@ -1116,9 +1111,7 @@ async fn cmd_uninstall_plugin<R: Runtime>(
     let plugin =
         app_handle.db().delete_plugin_by_id(plugin_id, &UpdateSource::from_window(&window))?;
 
-    plugin_manager
-        .uninstall(&WindowContext::from_window(&window), plugin.directory.as_str())
-        .await?;
+    plugin_manager.uninstall(&PluginWindowContext::new(&window), plugin.directory.as_str()).await?;
 
     Ok(plugin)
 }
@@ -1149,11 +1142,8 @@ async fn cmd_reload_plugins<R: Runtime>(
     app_handle: AppHandle<R>,
     window: WebviewWindow<R>,
     plugin_manager: State<'_, PluginManager>,
-) -> Result<(), String> {
-    plugin_manager
-        .initialize_all_plugins(&app_handle, &WindowContext::from_window(&window))
-        .await
-        .map_err(|e| e.to_string())?;
+) -> YaakResult<()> {
+    plugin_manager.initialize_all_plugins(&app_handle, &PluginWindowContext::new(&window)).await?;
     Ok(())
 }
 
@@ -1212,12 +1202,11 @@ async fn cmd_delete_all_http_responses<R: Runtime>(
 #[tauri::command]
 async fn cmd_get_workspace_meta<R: Runtime>(
     app_handle: AppHandle<R>,
-    window: WebviewWindow<R>,
     workspace_id: &str,
 ) -> YaakResult<WorkspaceMeta> {
     let db = app_handle.db();
     let workspace = db.get_workspace(workspace_id)?;
-    Ok(db.get_or_create_workspace_meta(&workspace.id, &UpdateSource::from_window(&window))?)
+    Ok(db.get_or_create_workspace_meta(&workspace.id)?)
 }
 
 #[tauri::command]
@@ -1227,13 +1216,13 @@ async fn cmd_new_child_window(
     label: &str,
     title: &str,
     inner_size: (f64, f64),
-) -> Result<(), String> {
+) -> YaakResult<()> {
     window::create_child_window(&parent_window, url, label, title, inner_size);
     Ok(())
 }
 
 #[tauri::command]
-async fn cmd_new_main_window(app_handle: AppHandle, url: &str) -> Result<(), String> {
+async fn cmd_new_main_window(app_handle: AppHandle, url: &str) -> YaakResult<()> {
     window::create_main_window(&app_handle, url);
     Ok(())
 }
@@ -1295,17 +1284,14 @@ pub fn run() {
         .plugin(tauri_plugin_os::init())
         .plugin(tauri_plugin_fs::init())
         .plugin(yaak_license::init())
+        .plugin(yaak_mac_window::init())
         .plugin(yaak_models::init())
         .plugin(yaak_plugins::init())
+        .plugin(yaak_crypto::init())
         .plugin(yaak_git::init())
         .plugin(yaak_ws::init())
         .plugin(yaak_sync::init());
 
-    #[cfg(target_os = "macos")]
-    {
-        builder = builder.plugin(tauri_plugin_mac_window::init());
-    }
-
     builder
         .setup(|app| {
             let app_data_dir = app.path().app_data_dir().unwrap();
@@ -1352,7 +1338,6 @@ pub fn run() {
             cmd_metadata,
             cmd_new_child_window,
             cmd_new_main_window,
-            cmd_parse_template,
             cmd_plugin_info,
             cmd_reload_plugins,
             cmd_render_template,
@@ -1362,6 +1347,12 @@ pub fn run() {
             cmd_template_functions,
             cmd_template_tokens_to_string,
             cmd_uninstall_plugin,
+            //
+            //
+            // Migrated commands
+            crate::commands::cmd_decrypt_template,
+            crate::commands::cmd_secure_template,
+            crate::commands::cmd_show_workspace_key,
         ])
         .register_uri_scheme_protocol("yaak", handle_uri_scheme)
         .build(tauri::generate_context!())
@@ -1495,11 +1486,11 @@ async fn call_frontend<R: Runtime>(
 
 fn get_window_from_window_context<R: Runtime>(
     app_handle: &AppHandle<R>,
-    window_context: &WindowContext,
+    window_context: &PluginWindowContext,
 ) -> Option<WebviewWindow<R>> {
     let label = match window_context {
-        WindowContext::Label { label } => label,
-        WindowContext::None => {
+        PluginWindowContext::Label { label, .. } => label,
+        PluginWindowContext::None => {
             return app_handle.webview_windows().iter().next().map(|(_, w)| w.to_owned());
         }
     };

src-tauri/src/notifications.rs

@@ -1,5 +1,6 @@
 use std::time::SystemTime;
 
+use crate::error::Result;
 use crate::history::{get_num_launches, get_os};
 use chrono::{DateTime, Duration, Utc};
 use log::debug;
@@ -44,16 +45,12 @@ impl YaakNotifier {
         }
     }
 
-    pub async fn seen<R: Runtime>(
-        &mut self,
-        window: &WebviewWindow<R>,
-        id: &str,
-    ) -> Result<(), String> {
+    pub async fn seen<R: Runtime>(&mut self, window: &WebviewWindow<R>, id: &str) -> Result<()> {
         let app_handle = window.app_handle();
         let mut seen = get_kv(app_handle).await?;
         seen.push(id.to_string());
         debug!("Marked notification as seen {}", id);
-        let seen_json = serde_json::to_string(&seen).map_err(|e| e.to_string())?;
+        let seen_json = serde_json::to_string(&seen)?;
         window.db().set_key_value_raw(
             KV_NAMESPACE,
             KV_KEY,
@@ -63,7 +60,7 @@ impl YaakNotifier {
         Ok(())
     }
 
-    pub async fn check<R: Runtime>(&mut self, window: &WebviewWindow<R>) -> Result<(), String> {
+    pub async fn check<R: Runtime>(&mut self, window: &WebviewWindow<R>) -> Result<()> {
         let app_handle = window.app_handle();
         let ignore_check = self.last_check.elapsed().unwrap().as_secs() < MAX_UPDATE_CHECK_SECONDS;
 
@@ -82,13 +79,13 @@ impl YaakNotifier {
                 ("launches", num_launches.to_string().as_str()),
                 ("platform", get_os()),
             ]);
-        let resp = req.send().await.map_err(|e| e.to_string())?;
+        let resp = req.send().await?;
         if resp.status() != 200 {
             debug!("Skipping notification status code {}", resp.status());
             return Ok(());
         }
 
-        let result = resp.json::<Value>().await.map_err(|e| e.to_string())?;
+        let result = resp.json::<Value>().await?;
 
         // Support both single and multiple notifications.
         // TODO: Remove support for single after April 2025
@@ -117,9 +114,9 @@ impl YaakNotifier {
     }
 }
 
-async fn get_kv<R: Runtime>(app_handle: &AppHandle<R>) -> Result<Vec<String>, String> {
+async fn get_kv<R: Runtime>(app_handle: &AppHandle<R>) -> Result<Vec<String>> {
     match app_handle.db().get_key_value_raw("notifications", "seen") {
         None => Ok(Vec::new()),
-        Some(v) => serde_json::from_str(&v.value).map_err(|e| e.to_string()),
+        Some(v) => Ok(serde_json::from_str(&v.value)?),
     }
 }

src-tauri/src/plugin_events.rs

@@ -1,6 +1,6 @@
 use crate::http_request::send_http_request;
 use crate::render::{render_http_request, render_json_value};
-use crate::window::{create_window, CreateWindowConfig};
+use crate::window::{CreateWindowConfig, create_window};
 use crate::{
     call_frontend, cookie_jar_from_window, environment_from_window, get_window_from_window_context,
     workspace_from_window,
@@ -15,8 +15,8 @@ use yaak_models::util::UpdateSource;
 use yaak_plugins::events::{
     Color, DeleteKeyValueResponse, EmptyPayload, FindHttpResponsesResponse,
     GetHttpRequestByIdResponse, GetKeyValueResponse, Icon, InternalEvent, InternalEventPayload,
-    RenderHttpRequestResponse, SendHttpRequestResponse, SetKeyValueResponse, ShowToastRequest,
-    TemplateRenderResponse, WindowContext, WindowNavigateEvent,
+    PluginWindowContext, RenderHttpRequestResponse, SendHttpRequestResponse, SetKeyValueResponse,
+    ShowToastRequest, TemplateRenderResponse, WindowNavigateEvent,
 };
 use yaak_plugins::manager::PluginManager;
 use yaak_plugins::plugin_handle::PluginHandle;
@@ -39,7 +39,7 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
         }
         InternalEventPayload::ShowToastRequest(req) => {
             match window_context {
-                WindowContext::Label { label } => app_handle
+                PluginWindowContext::Label { label, .. } => app_handle
                     .emit_to(label, "show_toast", req)
                     .expect("Failed to emit show_toast to window"),
                 _ => app_handle.emit("show_toast", req).expect("Failed to emit show_toast"),
@@ -54,17 +54,14 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
         InternalEventPayload::FindHttpResponsesRequest(req) => {
             let http_responses = app_handle
                 .db()
-                .list_http_responses_for_request(
-                    req.request_id.as_str(),
-                    req.limit.map(|l| l as u64),
-                )
+                .list_http_responses_for_request(&req.request_id, req.limit.map(|l| l as u64))
                 .unwrap_or_default();
             Some(InternalEventPayload::FindHttpResponsesResponse(FindHttpResponsesResponse {
                 http_responses,
             }))
         }
         InternalEventPayload::GetHttpRequestByIdRequest(req) => {
-            let http_request = app_handle.db().get_http_request(req.id.as_str()).ok();
+            let http_request = app_handle.db().get_http_request(&req.id).ok();
             Some(InternalEventPayload::GetHttpRequestByIdResponse(GetHttpRequestByIdResponse {
                 http_request,
             }))
@@ -111,10 +108,8 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
             Some(InternalEventPayload::TemplateRenderResponse(TemplateRenderResponse { data }))
         }
         InternalEventPayload::ErrorResponse(resp) => {
-            let window = get_window_from_window_context(app_handle, &window_context)
-                .expect("Failed to find window for plugin reload");
             let toast_event = plugin_handle.build_event_to_send(
-                &WindowContext::from_window(&window),
+                &window_context,
                 &InternalEventPayload::ShowToastRequest(ShowToastRequest {
                     message: format!(
                         "Plugin error from {}: {}",
@@ -143,7 +138,7 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
                 app_handle.db().upsert_plugin(&new_plugin, &UpdateSource::Plugin).unwrap();
             }
             let toast_event = plugin_handle.build_event_to_send(
-                &event.window_context,
+                &window_context,
                 &InternalEventPayload::ShowToastRequest(ShowToastRequest {
                     message: format!("Reloaded plugin {}", plugin_handle.dir),
                     icon: Some(Icon::Info),
@@ -221,13 +216,12 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
             {
                 let event_id = event.id.clone();
                 let plugin_handle = plugin_handle.clone();
-                let label = label.clone();
+                let window_context = window_context.clone();
                 tauri::async_runtime::spawn(async move {
                     while let Some(url) = navigation_rx.recv().await {
                         let url = url.to_string();
-                        let label = label.clone();
                         let event_to_send = plugin_handle.build_event_to_send(
-                            &WindowContext::Label { label },
+                            &window_context, // NOTE: Sending existing context on purpose here
                             &InternalEventPayload::WindowNavigateEvent(WindowNavigateEvent { url }),
                             Some(event_id.clone()),
                         );
@@ -239,12 +233,11 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
             {
                 let event_id = event.id.clone();
                 let plugin_handle = plugin_handle.clone();
-                let label = label.clone();
+                let window_context = window_context.clone();
                 tauri::async_runtime::spawn(async move {
                     while let Some(_) = close_rx.recv().await {
-                        let label = label.clone();
                         let event_to_send = plugin_handle.build_event_to_send(
-                            &WindowContext::Label { label },
+                            &window_context,
                             &InternalEventPayload::WindowCloseEvent,
                             Some(event_id.clone()),
                         );

src-tauri/vendored/plugins/template-function-file/build/index.js

@@ -1,54 +0,0 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var src_exports = {};
-__export(src_exports, {
-  plugin: () => plugin
-});
-module.exports = __toCommonJS(src_exports);
-var import_node_fs = __toESM(require("node:fs"));
-var plugin = {
-  templateFunctions: [{
-    name: "fs.readFile",
-    args: [{ title: "Select File", type: "file", name: "path", label: "File" }],
-    async onRender(_ctx, args) {
-      if (!args.values.path) return null;
-      try {
-        return import_node_fs.default.promises.readFile(args.values.path, "utf-8");
-      } catch (err) {
-        return null;
-      }
-    }
-  }]
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  plugin
-});

src-tauri/vendored/plugins/template-function-file/package.json

@@ -1,9 +0,0 @@
-{
-  "name": "@yaakapp/template-function-file",
-  "private": true,
-  "version": "0.0.1",
-  "scripts": {
-    "build": "yaakcli build ./src/index.ts",
-    "dev": "yaakcli dev ./src/index.js"
-  }
-}

src-tauri/yaak-common/Cargo.toml

@@ -1,8 +1,8 @@
 [package]
 name = "yaak-common"
 version = "0.1.0"
-publish = false
 edition = "2024"
+publish = false
 
 [dependencies]
 tauri = { workspace = true }

src-tauri/yaak-crypto/Cargo.toml

@@ -0,0 +1,20 @@
+[package]
+name = "yaak-crypto"
+links = "yaak-crypto"
+version = "0.1.0"
+edition = "2021"
+publish = false
+
+[dependencies]
+base32 = "0.5.1" # For encoding human-readable key
+base64 = "0.22.1" # For encoding in the database
+keyring = { version = "4.0.0-alpha.1", features = ["vendored"] }
+log = "0.4.26"
+serde = { workspace = true, features = ["derive"] }
+tauri = { workspace = true }
+thiserror = "2.0.12"
+yaak-models = { workspace = true }
+chacha20poly1305 = "0.10.1"
+
+[build-dependencies]
+tauri-plugin = { workspace = true, features = ["build"] }

src-tauri/yaak-crypto/build.rs

@@ -0,0 +1,9 @@
+const COMMANDS: &[&str] = &[
+    "enable_encryption",
+    "reveal_workspace_key",
+    "set_workspace_key",
+];
+
+fn main() {
+    tauri_plugin::Builder::new(COMMANDS).build();
+}

src-tauri/yaak-crypto/index.ts

@@ -0,0 +1,13 @@
+import { invoke } from '@tauri-apps/api/core';
+
+export function enableEncryption(workspaceId: string) {
+  return invoke<void>('plugin:yaak-crypto|enable_encryption', { workspaceId });
+}
+
+export function revealWorkspaceKey(workspaceId: string) {
+  return invoke<string>('plugin:yaak-crypto|reveal_workspace_key', { workspaceId });
+}
+
+export function setWorkspaceKey(args: { workspaceId: string; key: string }) {
+  return invoke<void>('plugin:yaak-crypto|set_workspace_key', args);
+}

src-tauri/yaak-crypto/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "@yaakapp-internal/crypto",
+  "private": true,
+  "version": "1.0.0",
+  "main": "index.ts"
+}

src-tauri/yaak-crypto/permissions/default.toml

@@ -0,0 +1,7 @@
+[default]
+description = "Default permissions for the plugin"
+permissions = [
+    "allow-enable-encryption",
+    "allow-reveal-workspace-key",
+    "allow-set-workspace-key",
+]

src-tauri/yaak-crypto/src/commands.rs

@@ -0,0 +1,31 @@
+use crate::error::Result;
+use crate::manager::EncryptionManagerExt;
+use tauri::{command, Runtime, WebviewWindow};
+
+#[command]
+pub(crate) async fn enable_encryption<R: Runtime>(
+    window: WebviewWindow<R>,
+    workspace_id: &str,
+) -> Result<()> {
+    window.crypto().ensure_workspace_key(workspace_id)?;
+    window.crypto().reveal_workspace_key(workspace_id)?;
+    Ok(())
+}
+
+#[command]
+pub(crate) async fn reveal_workspace_key<R: Runtime>(
+    window: WebviewWindow<R>,
+    workspace_id: &str,
+) -> Result<String> {
+    Ok(window.crypto().reveal_workspace_key(workspace_id)?)
+}
+
+#[command]
+pub(crate) async fn set_workspace_key<R: Runtime>(
+    window: WebviewWindow<R>,
+    workspace_id: &str,
+    key: &str,
+) -> Result<()> {
+    window.crypto().set_human_key(workspace_id, key)?;
+    Ok(())
+}

src-tauri/yaak-crypto/src/encryption.rs

@@ -0,0 +1,98 @@
+use crate::error::Error::{DecryptionError, EncryptionError, InvalidEncryptedData};
+use crate::error::Result;
+use chacha20poly1305::aead::generic_array::typenum::Unsigned;
+use chacha20poly1305::aead::{Aead, AeadCore, Key, KeyInit, OsRng};
+use chacha20poly1305::XChaCha20Poly1305;
+
+const ENCRYPTION_TAG: &str = "yA4k3nC";
+const ENCRYPTION_VERSION: u8 = 1;
+
+pub(crate) fn encrypt_data(data: &[u8], key: &Key<XChaCha20Poly1305>) -> Result<Vec<u8>> {
+    let nonce = XChaCha20Poly1305::generate_nonce(&mut OsRng);
+    let cipher = XChaCha20Poly1305::new(&key);
+    let ciphered_data = cipher.encrypt(&nonce, data).map_err(|_| EncryptionError)?;
+
+    let mut data: Vec<u8> = Vec::new();
+    data.extend_from_slice(ENCRYPTION_TAG.as_bytes()); // Tag
+    data.push(ENCRYPTION_VERSION); // Version
+    data.extend_from_slice(&nonce.as_slice()); // Nonce
+    data.extend_from_slice(&ciphered_data); // Ciphertext
+
+    Ok(data)
+}
+
+pub(crate) fn decrypt_data(cipher_data: &[u8], key: &Key<XChaCha20Poly1305>) -> Result<Vec<u8>> {
+    // Yaak Tag + ID + Version + Nonce + ... ciphertext ...
+    let (tag, rest) =
+        cipher_data.split_at_checked(ENCRYPTION_TAG.len()).ok_or(InvalidEncryptedData)?;
+    if tag != ENCRYPTION_TAG.as_bytes() {
+        return Err(InvalidEncryptedData);
+    }
+
+    let (version, rest) = rest.split_at_checked(1).ok_or(InvalidEncryptedData)?;
+    if version[0] != ENCRYPTION_VERSION {
+        return Err(InvalidEncryptedData);
+    }
+
+    let nonce_bytes = <XChaCha20Poly1305 as AeadCore>::NonceSize::to_usize();
+    let (nonce, ciphered_data) = rest.split_at_checked(nonce_bytes).ok_or(InvalidEncryptedData)?;
+
+    let cipher = XChaCha20Poly1305::new(&key);
+    cipher.decrypt(nonce.into(), ciphered_data).map_err(|_| DecryptionError)
+}
+
+#[cfg(test)]
+mod test {
+    use crate::encryption::{decrypt_data, encrypt_data};
+    use crate::error::Error::InvalidEncryptedData;
+    use crate::error::Result;
+    use chacha20poly1305::aead::OsRng;
+    use chacha20poly1305::{KeyInit, XChaCha20Poly1305};
+
+    #[test]
+    fn test_encrypt_decrypt() -> Result<()> {
+        let key = XChaCha20Poly1305::generate_key(OsRng);
+        let encrypted = encrypt_data("hello world".as_bytes(), &key)?;
+        let decrypted = decrypt_data(encrypted.as_slice(), &key)?;
+        assert_eq!(String::from_utf8(decrypted).unwrap(), "hello world");
+        Ok(())
+    }
+
+    #[test]
+    fn test_decrypt_empty() -> Result<()> {
+        let key = XChaCha20Poly1305::generate_key(OsRng);
+        let encrypted = encrypt_data(&[], &key)?;
+        assert_eq!(encrypted.len(), 48);
+        let decrypted = decrypt_data(encrypted.as_slice(), &key)?;
+        assert_eq!(String::from_utf8(decrypted).unwrap(), "");
+        Ok(())
+    }
+
+    #[test]
+    fn test_decrypt_bad_version() -> Result<()> {
+        let key = XChaCha20Poly1305::generate_key(OsRng);
+        let mut encrypted = encrypt_data("hello world".as_bytes(), &key)?;
+        encrypted[7] = 0;
+        let decrypted = decrypt_data(encrypted.as_slice(), &key);
+        assert!(matches!(decrypted, Err(InvalidEncryptedData)));
+        Ok(())
+    }
+
+    #[test]
+    fn test_decrypt_bad_tag() -> Result<()> {
+        let key = XChaCha20Poly1305::generate_key(OsRng);
+        let mut encrypted = encrypt_data("hello world".as_bytes(), &key)?;
+        encrypted[0] = 2;
+        let decrypted = decrypt_data(encrypted.as_slice(), &key);
+        assert!(matches!(decrypted, Err(InvalidEncryptedData)));
+        Ok(())
+    }
+
+    #[test]
+    fn test_decrypt_unencrypted_data() -> Result<()> {
+        let key = XChaCha20Poly1305::generate_key(OsRng);
+        let decrypted = decrypt_data("123".as_bytes(), &key);
+        assert!(matches!(decrypted, Err(InvalidEncryptedData)));
+        Ok(())
+    }
+}

src-tauri/yaak-crypto/src/error.rs

@@ -0,0 +1,47 @@
+use serde::{Serialize, Serializer};
+use std::io;
+use thiserror::Error;
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error(transparent)]
+    DbError(#[from] yaak_models::error::Error),
+
+    #[error("Keyring error: {0}")]
+    KeyringError(#[from] keyring::Error),
+
+    #[error("Missing workspace encryption key")]
+    MissingWorkspaceKey,
+
+    #[error("Incorrect workspace key")]
+    IncorrectWorkspaceKey,
+
+    #[error("Crypto IO error: {0}")]
+    IoError(#[from] io::Error),
+
+    #[error("Failed to encrypt")]
+    EncryptionError,
+
+    #[error("Failed to decrypt")]
+    DecryptionError,
+
+    #[error("Invalid encrypted data")]
+    InvalidEncryptedData,
+
+    #[error("Invalid key provided")]
+    InvalidHumanKey,
+
+    #[error("Encryption error: {0}")]
+    GenericError(String),
+}
+
+impl Serialize for Error {
+    fn serialize<S>(&self, serializer: S) -> std::result::Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        serializer.serialize_str(self.to_string().as_ref())
+    }
+}
+
+pub type Result<T> = std::result::Result<T, Error>;

src-tauri/yaak-crypto/src/lib.rs

@@ -0,0 +1,27 @@
+extern crate core;
+
+use crate::commands::*;
+use crate::manager::EncryptionManager;
+use tauri::plugin::{Builder, TauriPlugin};
+use tauri::{generate_handler, Manager, Runtime};
+
+mod commands;
+pub mod encryption;
+pub mod error;
+pub mod manager;
+mod master_key;
+mod workspace_key;
+
+pub fn init<R: Runtime>() -> TauriPlugin<R> {
+    Builder::new("yaak-crypto")
+        .invoke_handler(generate_handler![
+            enable_encryption,
+            reveal_workspace_key,
+            set_workspace_key
+        ])
+        .setup(|app, _api| {
+            app.manage(EncryptionManager::new(app.app_handle()));
+            Ok(())
+        })
+        .build()
+}

src-tauri/yaak-crypto/src/manager.rs

@@ -0,0 +1,171 @@
+use crate::error::Error::{GenericError, IncorrectWorkspaceKey, MissingWorkspaceKey};
+use crate::error::{Error, Result};
+use crate::master_key::MasterKey;
+use crate::workspace_key::WorkspaceKey;
+use base64::prelude::BASE64_STANDARD;
+use base64::Engine;
+use log::{info, warn};
+use std::collections::HashMap;
+use std::sync::{Arc, Mutex};
+use tauri::{AppHandle, Manager, Runtime, State};
+use yaak_models::models::{EncryptedKey, Workspace, WorkspaceMeta};
+use yaak_models::query_manager::{QueryManager, QueryManagerExt};
+use yaak_models::util::{generate_id_of_length, UpdateSource};
+
+const KEY_USER: &str = "yaak-encryption-key";
+
+pub trait EncryptionManagerExt<'a, R> {
+    fn crypto(&'a self) -> State<'a, EncryptionManager>;
+}
+
+impl<'a, R: Runtime, M: Manager<R>> EncryptionManagerExt<'a, R> for M {
+    fn crypto(&'a self) -> State<'a, EncryptionManager> {
+        self.state::<EncryptionManager>()
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct EncryptionManager {
+    cached_master_key: Arc<Mutex<Option<MasterKey>>>,
+    cached_workspace_keys: Arc<Mutex<HashMap<String, WorkspaceKey>>>,
+    query_manager: QueryManager,
+}
+
+impl EncryptionManager {
+    pub fn new<R: Runtime>(app_handle: &AppHandle<R>) -> Self {
+        Self {
+            cached_master_key: Default::default(),
+            cached_workspace_keys: Default::default(),
+            query_manager: app_handle.db_manager().inner().clone(),
+        }
+    }
+
+    pub fn encrypt(&self, workspace_id: &str, data: &[u8]) -> Result<Vec<u8>> {
+        let workspace_secret = self.get_workspace_key(workspace_id)?;
+        workspace_secret.encrypt(data)
+    }
+
+    pub fn decrypt(&self, workspace_id: &str, data: &[u8]) -> Result<Vec<u8>> {
+        let workspace_secret = self.get_workspace_key(workspace_id)?;
+        workspace_secret.decrypt(data)
+    }
+
+    pub fn reveal_workspace_key(&self, workspace_id: &str) -> Result<String> {
+        let key = self.get_workspace_key(workspace_id)?;
+        key.to_human()
+    }
+
+    pub fn set_human_key(&self, workspace_id: &str, human_key: &str) -> Result<WorkspaceMeta> {
+        let wkey = WorkspaceKey::from_human(human_key)?;
+
+        let workspace = self.query_manager.connect().get_workspace(workspace_id)?;
+        let encryption_key_challenge = match workspace.encryption_key_challenge {
+            None => return self.set_workspace_key(workspace_id, &wkey),
+            Some(c) => c,
+        };
+
+        let encryption_key_challenge = match BASE64_STANDARD.decode(encryption_key_challenge) {
+            Ok(c) => c,
+            Err(_) => return Err(GenericError("Failed to decode workspace challenge".to_string())),
+        };
+
+        if let Err(_) = wkey.decrypt(encryption_key_challenge.as_slice()) {
+            return Err(IncorrectWorkspaceKey);
+        };
+
+        self.set_workspace_key(workspace_id, &wkey)
+    }
+
+    pub(crate) fn set_workspace_key(
+        &self,
+        workspace_id: &str,
+        wkey: &WorkspaceKey,
+    ) -> Result<WorkspaceMeta> {
+        info!("Created workspace key for {workspace_id}");
+
+        let encrypted_key = BASE64_STANDARD.encode(self.get_master_key()?.encrypt(wkey.raw_key())?);
+        let encrypted_key = EncryptedKey { encrypted_key };
+        let encryption_key_challenge = wkey.encrypt(generate_id_of_length(50).as_bytes())?;
+        let encryption_key_challenge = Some(BASE64_STANDARD.encode(encryption_key_challenge));
+
+        let workspace_meta = self.query_manager.with_tx::<WorkspaceMeta, Error>(|tx| {
+            let workspace = tx.get_workspace(workspace_id)?;
+            let workspace_meta = tx.get_or_create_workspace_meta(workspace_id)?;
+            tx.upsert_workspace(
+                &Workspace {
+                    encryption_key_challenge,
+                    ..workspace
+                },
+                &UpdateSource::Background,
+            )?;
+
+            Ok(tx.upsert_workspace_meta(
+                &WorkspaceMeta {
+                    encryption_key: Some(encrypted_key.clone()),
+                    ..workspace_meta
+                },
+                &UpdateSource::Background,
+            )?)
+        })?;
+
+        let mut cache = self.cached_workspace_keys.lock().unwrap();
+        cache.insert(workspace_id.to_string(), wkey.clone());
+
+        Ok(workspace_meta)
+    }
+
+    pub(crate) fn ensure_workspace_key(&self, workspace_id: &str) -> Result<WorkspaceMeta> {
+        let workspace_meta =
+            self.query_manager.connect().get_or_create_workspace_meta(workspace_id)?;
+
+        // Already exists
+        if let Some(_) = workspace_meta.encryption_key {
+            warn!("Tried to create workspace key when one already exists for {workspace_id}");
+            return Ok(workspace_meta);
+        }
+
+        let wkey = WorkspaceKey::create()?;
+        self.set_workspace_key(workspace_id, &wkey)
+    }
+
+    fn get_workspace_key(&self, workspace_id: &str) -> Result<WorkspaceKey> {
+        {
+            let cache = self.cached_workspace_keys.lock().unwrap();
+            if let Some(k) = cache.get(workspace_id) {
+                return Ok(k.clone());
+            }
+        };
+
+        let db = self.query_manager.connect();
+        let workspace_meta = db.get_or_create_workspace_meta(workspace_id)?;
+
+        let key = match workspace_meta.encryption_key {
+            None => return Err(MissingWorkspaceKey),
+            Some(k) => k,
+        };
+
+        let mkey = self.get_master_key()?;
+        let decoded_key = BASE64_STANDARD
+            .decode(key.encrypted_key)
+            .map_err(|e| GenericError(format!("Failed to decode workspace key {e:?}")))?;
+        let raw_key = mkey.decrypt(decoded_key.as_slice())?;
+        info!("Got existing workspace key for {workspace_id}");
+        let wkey = WorkspaceKey::from_raw_key(raw_key.as_slice());
+
+        Ok(wkey)
+    }
+
+    fn get_master_key(&self) -> Result<MasterKey> {
+        {
+            let master_secret = self.cached_master_key.lock().unwrap();
+            if let Some(k) = master_secret.as_ref() {
+                return Ok(k.to_owned());
+            }
+        }
+
+        let mkey = MasterKey::get_or_create(KEY_USER)?;
+        let mut master_secret = self.cached_master_key.lock().unwrap();
+        *master_secret = Some(mkey.clone());
+        Ok(mkey)
+    }
+}

src-tauri/yaak-crypto/src/master_key.rs

@@ -0,0 +1,78 @@
+use crate::encryption::{decrypt_data, encrypt_data};
+use crate::error::Error::GenericError;
+use crate::error::Result;
+use base32::Alphabet;
+use chacha20poly1305::aead::{Key, KeyInit, OsRng};
+use chacha20poly1305::XChaCha20Poly1305;
+use keyring::{Entry, Error};
+use log::info;
+
+const HUMAN_PREFIX: &str = "YKM_";
+
+#[derive(Debug, Clone)]
+pub(crate) struct MasterKey {
+    key: Key<XChaCha20Poly1305>,
+}
+
+impl MasterKey {
+    pub(crate) fn get_or_create(user: &str) -> Result<Self> {
+        let entry = Entry::new("app.yaak.desktop.EncryptionKey", user)?;
+
+        let key = match entry.get_password() {
+            Ok(encoded) => {
+                let without_prefix = encoded.strip_prefix(HUMAN_PREFIX).unwrap_or(&encoded);
+                let key_bytes = base32::decode(Alphabet::Crockford {}, &without_prefix)
+                    .ok_or(GenericError("Failed to decode master key".to_string()))?;
+                Key::<XChaCha20Poly1305>::clone_from_slice(key_bytes.as_slice())
+            }
+            Err(Error::NoEntry) => {
+                info!("Creating new master key");
+                let key = XChaCha20Poly1305::generate_key(OsRng);
+                let encoded = base32::encode(Alphabet::Crockford {}, key.as_slice());
+                let with_prefix = format!("{HUMAN_PREFIX}{encoded}");
+                entry.set_password(&with_prefix)?;
+                key
+            }
+            Err(e) => return Err(GenericError(e.to_string())),
+        };
+
+        Ok(Self { key })
+    }
+
+    pub(crate) fn encrypt(&self, data: &[u8]) -> Result<Vec<u8>> {
+        encrypt_data(data, &self.key)
+    }
+
+    pub(crate) fn decrypt(&self, data: &[u8]) -> Result<Vec<u8>> {
+        decrypt_data(data, &self.key)
+    }
+
+    #[cfg(test)]
+    pub(crate) fn test_key() -> Self {
+        let key: Key<XChaCha20Poly1305> = Key::<XChaCha20Poly1305>::clone_from_slice(
+            "00000000000000000000000000000000".as_bytes(),
+        );
+        Self { key }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::error::Result;
+    use crate::master_key::MasterKey;
+
+    #[test]
+    fn test_master_key() -> Result<()> {
+        // Test out the master key
+        let mkey = MasterKey::test_key();
+        let encrypted = mkey.encrypt("hello".as_bytes())?;
+        let decrypted = mkey.decrypt(encrypted.as_slice()).unwrap();
+        assert_eq!(decrypted, "hello".as_bytes().to_vec());
+
+        let mkey = MasterKey::test_key();
+        let decrypted = mkey.decrypt(encrypted.as_slice()).unwrap();
+        assert_eq!(decrypted, "hello".as_bytes().to_vec());
+
+        Ok(())
+    }
+}

src-tauri/yaak-crypto/src/workspace_key.rs

@@ -0,0 +1,116 @@
+use crate::encryption::{decrypt_data, encrypt_data};
+use crate::error::Error::InvalidHumanKey;
+use crate::error::Result;
+use base32::Alphabet;
+use chacha20poly1305::aead::{Key, KeyInit, OsRng};
+use chacha20poly1305::{KeySizeUser, XChaCha20Poly1305};
+
+#[derive(Debug, Clone)]
+pub struct WorkspaceKey {
+    key: Key<XChaCha20Poly1305>,
+}
+
+const HUMAN_PREFIX: &str = "YK";
+
+impl WorkspaceKey {
+    pub(crate) fn to_human(&self) -> Result<String> {
+        let encoded = base32::encode(Alphabet::Crockford {}, self.key.as_slice());
+        let with_prefix = format!("{HUMAN_PREFIX}{encoded}");
+        let with_separators = with_prefix
+            .chars()
+            .collect::<Vec<_>>()
+            .chunks(6)
+            .map(|chunk| chunk.iter().collect::<String>())
+            .collect::<Vec<_>>()
+            .join("-");
+        Ok(with_separators)
+    }
+
+    #[allow(dead_code)]
+    pub(crate) fn from_human(human_key: &str) -> Result<Self> {
+        let without_prefix = human_key.strip_prefix(HUMAN_PREFIX).unwrap_or(human_key);
+        let without_separators = without_prefix.replace("-", "");
+        let key =
+            base32::decode(Alphabet::Crockford {}, &without_separators).ok_or(InvalidHumanKey)?;
+        if key.len() != XChaCha20Poly1305::key_size() {
+            return Err(InvalidHumanKey);
+        }
+        Ok(Self::from_raw_key(key.as_slice()))
+    }
+
+    pub(crate) fn from_raw_key(key: &[u8]) -> Self {
+        Self {
+            key: Key::<XChaCha20Poly1305>::clone_from_slice(key),
+        }
+    }
+
+    pub(crate) fn raw_key(&self) -> &[u8] {
+        self.key.as_slice()
+    }
+
+    pub(crate) fn create() -> Result<Self> {
+        let key = XChaCha20Poly1305::generate_key(OsRng);
+        Ok(Self::from_raw_key(key.as_slice()))
+    }
+
+    pub(crate) fn encrypt(&self, data: &[u8]) -> Result<Vec<u8>> {
+        encrypt_data(data, &self.key)
+    }
+
+    pub(crate) fn decrypt(&self, data: &[u8]) -> Result<Vec<u8>> {
+        decrypt_data(data, &self.key)
+    }
+
+    #[cfg(test)]
+    pub(crate) fn test_key() -> Self {
+        Self::from_raw_key("f1a2d4b3c8e799af1456be3478a4c3f2".as_bytes())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::error::Error::InvalidHumanKey;
+    use crate::error::Result;
+    use crate::workspace_key::WorkspaceKey;
+
+    #[test]
+    fn test_persisted_key() -> Result<()> {
+        let key = WorkspaceKey::test_key();
+        let encrypted = key.encrypt("hello".as_bytes())?;
+        assert_eq!(key.decrypt(encrypted.as_slice())?, "hello".as_bytes());
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_human_format() -> Result<()> {
+        let key = WorkspaceKey::test_key();
+
+        let encrypted = key.encrypt("hello".as_bytes())?;
+        assert_eq!(key.decrypt(encrypted.as_slice())?, "hello".as_bytes());
+
+        let human = key.to_human()?;
+        assert_eq!(human, "YKCRRP-2CK46H-H36RSR-CMVKJE-B1CRRK-8D9PC9-JK6D1Q-71GK8R-SKCRS0");
+        assert_eq!(
+            WorkspaceKey::from_human(&human)?.decrypt(encrypted.as_slice())?,
+            "hello".as_bytes()
+        );
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_from_human_invalid() -> Result<()> {
+        assert!(matches!(
+            WorkspaceKey::from_human(
+                "YKCRRP-2CK46H-H36RSR-CMVKJE-B1CRRK-8D9PC9-JK6D1Q-71GK8R-SKCRS0-H3X38D",
+            ),
+            Err(InvalidHumanKey)
+        ));
+
+        assert!(matches!(WorkspaceKey::from_human("bad-key",), Err(InvalidHumanKey)));
+        assert!(matches!(WorkspaceKey::from_human("",), Err(InvalidHumanKey)));
+
+        Ok(())
+    }
+}

src-tauri/yaak-git/Cargo.toml

@@ -9,8 +9,8 @@ publish = false
 chrono = { version = "0.4.38", features = ["serde"] }
 git2 = { version = "0.20.0", features = ["vendored-libgit2", "vendored-openssl"] }
 log = "0.4.22"
-serde = { version = "1.0.215", features = ["derive"] }
-serde_json = "1.0.132"
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
 serde_yaml = "0.9.34"
 tauri = { workspace = true }
 thiserror = { workspace = true }

src-tauri/yaak-git/bindings/gen_models.ts

@@ -20,4 +20,4 @@ export type SyncModel = { "type": "workspace" } & Workspace | { "type": "environ
 
 export type WebsocketRequest = { model: "websocket_request", id: string, createdAt: string, updatedAt: string, workspaceId: string, folderId: string | null, authentication: Record<string, any>, authenticationType: string | null, description: string, headers: Array<HttpRequestHeader>, message: string, name: string, sortPriority: number, url: string, urlParameters: Array<HttpUrlParameter>, };
 
-export type Workspace = { model: "workspace", id: string, createdAt: string, updatedAt: string, name: string, description: string, settingValidateCertificates: boolean, settingFollowRedirects: boolean, settingRequestTimeout: number, };
+export type Workspace = { model: "workspace", id: string, createdAt: string, updatedAt: string, name: string, description: string, encryptionKeyChallenge: string | null, settingValidateCertificates: boolean, settingFollowRedirects: boolean, settingRequestTimeout: number, };

src-tauri/yaak-git/permissions/autogenerated/commands/add.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-add"
-description = "Enables the add command without any pre-configured scope."
-commands.allow = ["add"]
-
-[[permission]]
-identifier = "deny-add"
-description = "Denies the add command without any pre-configured scope."
-commands.deny = ["add"]

src-tauri/yaak-git/permissions/autogenerated/commands/branch.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-branch"
-description = "Enables the branch command without any pre-configured scope."
-commands.allow = ["branch"]
-
-[[permission]]
-identifier = "deny-branch"
-description = "Denies the branch command without any pre-configured scope."
-commands.deny = ["branch"]

src-tauri/yaak-git/permissions/autogenerated/commands/checkout.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-checkout"
-description = "Enables the checkout command without any pre-configured scope."
-commands.allow = ["checkout"]
-
-[[permission]]
-identifier = "deny-checkout"
-description = "Denies the checkout command without any pre-configured scope."
-commands.deny = ["checkout"]

src-tauri/yaak-git/permissions/autogenerated/commands/checkout_remote.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-checkout-remote"
-description = "Enables the checkout_remote command without any pre-configured scope."
-commands.allow = ["checkout_remote"]
-
-[[permission]]
-identifier = "deny-checkout-remote"
-description = "Denies the checkout_remote command without any pre-configured scope."
-commands.deny = ["checkout_remote"]

src-tauri/yaak-git/permissions/autogenerated/commands/commit.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-commit"
-description = "Enables the commit command without any pre-configured scope."
-commands.allow = ["commit"]
-
-[[permission]]
-identifier = "deny-commit"
-description = "Denies the commit command without any pre-configured scope."
-commands.deny = ["commit"]

src-tauri/yaak-git/permissions/autogenerated/commands/delete_branch.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-delete-branch"
-description = "Enables the delete_branch command without any pre-configured scope."
-commands.allow = ["delete_branch"]
-
-[[permission]]
-identifier = "deny-delete-branch"
-description = "Denies the delete_branch command without any pre-configured scope."
-commands.deny = ["delete_branch"]

src-tauri/yaak-git/permissions/autogenerated/commands/fetch_all.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-fetch-all"
-description = "Enables the fetch_all command without any pre-configured scope."
-commands.allow = ["fetch_all"]
-
-[[permission]]
-identifier = "deny-fetch-all"
-description = "Denies the fetch_all command without any pre-configured scope."
-commands.deny = ["fetch_all"]

src-tauri/yaak-git/permissions/autogenerated/commands/initialize.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-initialize"
-description = "Enables the initialize command without any pre-configured scope."
-commands.allow = ["initialize"]
-
-[[permission]]
-identifier = "deny-initialize"
-description = "Denies the initialize command without any pre-configured scope."
-commands.deny = ["initialize"]

src-tauri/yaak-git/permissions/autogenerated/commands/log.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-log"
-description = "Enables the log command without any pre-configured scope."
-commands.allow = ["log"]
-
-[[permission]]
-identifier = "deny-log"
-description = "Denies the log command without any pre-configured scope."
-commands.deny = ["log"]

src-tauri/yaak-git/permissions/autogenerated/commands/merge_branch.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-merge-branch"
-description = "Enables the merge_branch command without any pre-configured scope."
-commands.allow = ["merge_branch"]
-
-[[permission]]
-identifier = "deny-merge-branch"
-description = "Denies the merge_branch command without any pre-configured scope."
-commands.deny = ["merge_branch"]

src-tauri/yaak-git/permissions/autogenerated/commands/pull.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-pull"
-description = "Enables the pull command without any pre-configured scope."
-commands.allow = ["pull"]
-
-[[permission]]
-identifier = "deny-pull"
-description = "Denies the pull command without any pre-configured scope."
-commands.deny = ["pull"]

src-tauri/yaak-git/permissions/autogenerated/commands/push.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-push"
-description = "Enables the push command without any pre-configured scope."
-commands.allow = ["push"]
-
-[[permission]]
-identifier = "deny-push"
-description = "Denies the push command without any pre-configured scope."
-commands.deny = ["push"]

src-tauri/yaak-git/permissions/autogenerated/commands/status.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-status"
-description = "Enables the status command without any pre-configured scope."
-commands.allow = ["status"]
-
-[[permission]]
-identifier = "deny-status"
-description = "Denies the status command without any pre-configured scope."
-commands.deny = ["status"]

src-tauri/yaak-git/permissions/autogenerated/commands/unstage.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-unstage"
-description = "Enables the unstage command without any pre-configured scope."
-commands.allow = ["unstage"]
-
-[[permission]]
-identifier = "deny-unstage"
-description = "Denies the unstage command without any pre-configured scope."
-commands.deny = ["unstage"]

src-tauri/yaak-git/permissions/autogenerated/reference.md

@@ -1,391 +0,0 @@
-## Default Permission
-
-Default permissions for the plugin
-
-- `allow-add`
-- `allow-branch`
-- `allow-checkout`
-- `allow-commit`
-- `allow-delete-branch`
-- `allow-fetch-all`
-- `allow-initialize`
-- `allow-log`
-- `allow-merge-branch`
-- `allow-pull`
-- `allow-push`
-- `allow-status`
-- `allow-unstage`
-
-## Permission Table
-
-<table>
-<tr>
-<th>Identifier</th>
-<th>Description</th>
-</tr>
-
-
-<tr>
-<td>
-
-`yaak-git:allow-add`
-
-</td>
-<td>
-
-Enables the add command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:deny-add`
-
-</td>
-<td>
-
-Denies the add command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:allow-branch`
-
-</td>
-<td>
-
-Enables the branch command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:deny-branch`
-
-</td>
-<td>
-
-Denies the branch command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:allow-checkout`
-
-</td>
-<td>
-
-Enables the checkout command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:deny-checkout`
-
-</td>
-<td>
-
-Denies the checkout command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:allow-checkout-remote`
-
-</td>
-<td>
-
-Enables the checkout_remote command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:deny-checkout-remote`
-
-</td>
-<td>
-
-Denies the checkout_remote command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:allow-commit`
-
-</td>
-<td>
-
-Enables the commit command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:deny-commit`
-
-</td>
-<td>
-
-Denies the commit command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:allow-delete-branch`
-
-</td>
-<td>
-
-Enables the delete_branch command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:deny-delete-branch`
-
-</td>
-<td>
-
-Denies the delete_branch command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:allow-fetch-all`
-
-</td>
-<td>
-
-Enables the fetch_all command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:deny-fetch-all`
-
-</td>
-<td>
-
-Denies the fetch_all command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:allow-initialize`
-
-</td>
-<td>
-
-Enables the initialize command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:deny-initialize`
-
-</td>
-<td>
-
-Denies the initialize command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:allow-log`
-
-</td>
-<td>
-
-Enables the log command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:deny-log`
-
-</td>
-<td>
-
-Denies the log command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:allow-merge-branch`
-
-</td>
-<td>
-
-Enables the merge_branch command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:deny-merge-branch`
-
-</td>
-<td>
-
-Denies the merge_branch command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:allow-pull`
-
-</td>
-<td>
-
-Enables the pull command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:deny-pull`
-
-</td>
-<td>
-
-Denies the pull command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:allow-push`
-
-</td>
-<td>
-
-Enables the push command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:deny-push`
-
-</td>
-<td>
-
-Denies the push command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:allow-status`
-
-</td>
-<td>
-
-Enables the status command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:deny-status`
-
-</td>
-<td>
-
-Denies the status command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:allow-unstage`
-
-</td>
-<td>
-
-Enables the unstage command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-git:deny-unstage`
-
-</td>
-<td>
-
-Denies the unstage command without any pre-configured scope.
-
-</td>
-</tr>
-</table>

src-tauri/yaak-git/permissions/schemas/schema.json

@@ -1,445 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "PermissionFile",
-  "description": "Permission file that can define a default permission, a set of permissions or a list of inlined permissions.",
-  "type": "object",
-  "properties": {
-    "default": {
-      "description": "The default permission set for the plugin",
-      "anyOf": [
-        {
-          "$ref": "#/definitions/DefaultPermission"
-        },
-        {
-          "type": "null"
-        }
-      ]
-    },
-    "set": {
-      "description": "A list of permissions sets defined",
-      "type": "array",
-      "items": {
-        "$ref": "#/definitions/PermissionSet"
-      }
-    },
-    "permission": {
-      "description": "A list of inlined permissions",
-      "default": [],
-      "type": "array",
-      "items": {
-        "$ref": "#/definitions/Permission"
-      }
-    }
-  },
-  "definitions": {
-    "DefaultPermission": {
-      "description": "The default permission set of the plugin.\n\nWorks similarly to a permission with the \"default\" identifier.",
-      "type": "object",
-      "required": [
-        "permissions"
-      ],
-      "properties": {
-        "version": {
-          "description": "The version of the permission.",
-          "type": [
-            "integer",
-            "null"
-          ],
-          "format": "uint64",
-          "minimum": 1.0
-        },
-        "description": {
-          "description": "Human-readable description of what the permission does. Tauri convention is to use `<h4>` headings in markdown content for Tauri documentation generation purposes.",
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "permissions": {
-          "description": "All permissions this set contains.",
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        }
-      }
-    },
-    "PermissionSet": {
-      "description": "A set of direct permissions grouped together under a new name.",
-      "type": "object",
-      "required": [
-        "description",
-        "identifier",
-        "permissions"
-      ],
-      "properties": {
-        "identifier": {
-          "description": "A unique identifier for the permission.",
-          "type": "string"
-        },
-        "description": {
-          "description": "Human-readable description of what the permission does.",
-          "type": "string"
-        },
-        "permissions": {
-          "description": "All permissions this set contains.",
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/PermissionKind"
-          }
-        }
-      }
-    },
-    "Permission": {
-      "description": "Descriptions of explicit privileges of commands.\n\nIt can enable commands to be accessible in the frontend of the application.\n\nIf the scope is defined it can be used to fine grain control the access of individual or multiple commands.",
-      "type": "object",
-      "required": [
-        "identifier"
-      ],
-      "properties": {
-        "version": {
-          "description": "The version of the permission.",
-          "type": [
-            "integer",
-            "null"
-          ],
-          "format": "uint64",
-          "minimum": 1.0
-        },
-        "identifier": {
-          "description": "A unique identifier for the permission.",
-          "type": "string"
-        },
-        "description": {
-          "description": "Human-readable description of what the permission does. Tauri internal convention is to use `<h4>` headings in markdown content for Tauri documentation generation purposes.",
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "commands": {
-          "description": "Allowed or denied commands when using this permission.",
-          "default": {
-            "allow": [],
-            "deny": []
-          },
-          "allOf": [
-            {
-              "$ref": "#/definitions/Commands"
-            }
-          ]
-        },
-        "scope": {
-          "description": "Allowed or denied scoped when using this permission.",
-          "allOf": [
-            {
-              "$ref": "#/definitions/Scopes"
-            }
-          ]
-        },
-        "platforms": {
-          "description": "Target platforms this permission applies. By default all platforms are affected by this permission.",
-          "type": [
-            "array",
-            "null"
-          ],
-          "items": {
-            "$ref": "#/definitions/Target"
-          }
-        }
-      }
-    },
-    "Commands": {
-      "description": "Allowed and denied commands inside a permission.\n\nIf two commands clash inside of `allow` and `deny`, it should be denied by default.",
-      "type": "object",
-      "properties": {
-        "allow": {
-          "description": "Allowed command.",
-          "default": [],
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        },
-        "deny": {
-          "description": "Denied command, which takes priority.",
-          "default": [],
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        }
-      }
-    },
-    "Scopes": {
-      "description": "An argument for fine grained behavior control of Tauri commands.\n\nIt can be of any serde serializable type and is used to allow or prevent certain actions inside a Tauri command. The configured scope is passed to the command and will be enforced by the command implementation.\n\n## Example\n\n```json { \"allow\": [{ \"path\": \"$HOME/**\" }], \"deny\": [{ \"path\": \"$HOME/secret.txt\" }] } ```",
-      "type": "object",
-      "properties": {
-        "allow": {
-          "description": "Data that defines what is allowed by the scope.",
-          "type": [
-            "array",
-            "null"
-          ],
-          "items": {
-            "$ref": "#/definitions/Value"
-          }
-        },
-        "deny": {
-          "description": "Data that defines what is denied by the scope. This should be prioritized by validation logic.",
-          "type": [
-            "array",
-            "null"
-          ],
-          "items": {
-            "$ref": "#/definitions/Value"
-          }
-        }
-      }
-    },
-    "Value": {
-      "description": "All supported ACL values.",
-      "anyOf": [
-        {
-          "description": "Represents a null JSON value.",
-          "type": "null"
-        },
-        {
-          "description": "Represents a [`bool`].",
-          "type": "boolean"
-        },
-        {
-          "description": "Represents a valid ACL [`Number`].",
-          "allOf": [
-            {
-              "$ref": "#/definitions/Number"
-            }
-          ]
-        },
-        {
-          "description": "Represents a [`String`].",
-          "type": "string"
-        },
-        {
-          "description": "Represents a list of other [`Value`]s.",
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/Value"
-          }
-        },
-        {
-          "description": "Represents a map of [`String`] keys to [`Value`]s.",
-          "type": "object",
-          "additionalProperties": {
-            "$ref": "#/definitions/Value"
-          }
-        }
-      ]
-    },
-    "Number": {
-      "description": "A valid ACL number.",
-      "anyOf": [
-        {
-          "description": "Represents an [`i64`].",
-          "type": "integer",
-          "format": "int64"
-        },
-        {
-          "description": "Represents a [`f64`].",
-          "type": "number",
-          "format": "double"
-        }
-      ]
-    },
-    "Target": {
-      "description": "Platform target.",
-      "oneOf": [
-        {
-          "description": "MacOS.",
-          "type": "string",
-          "enum": [
-            "macOS"
-          ]
-        },
-        {
-          "description": "Windows.",
-          "type": "string",
-          "enum": [
-            "windows"
-          ]
-        },
-        {
-          "description": "Linux.",
-          "type": "string",
-          "enum": [
-            "linux"
-          ]
-        },
-        {
-          "description": "Android.",
-          "type": "string",
-          "enum": [
-            "android"
-          ]
-        },
-        {
-          "description": "iOS.",
-          "type": "string",
-          "enum": [
-            "iOS"
-          ]
-        }
-      ]
-    },
-    "PermissionKind": {
-      "type": "string",
-      "oneOf": [
-        {
-          "description": "Enables the add command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-add"
-        },
-        {
-          "description": "Denies the add command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-add"
-        },
-        {
-          "description": "Enables the branch command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-branch"
-        },
-        {
-          "description": "Denies the branch command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-branch"
-        },
-        {
-          "description": "Enables the checkout command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-checkout"
-        },
-        {
-          "description": "Denies the checkout command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-checkout"
-        },
-        {
-          "description": "Enables the checkout_remote command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-checkout-remote"
-        },
-        {
-          "description": "Denies the checkout_remote command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-checkout-remote"
-        },
-        {
-          "description": "Enables the commit command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-commit"
-        },
-        {
-          "description": "Denies the commit command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-commit"
-        },
-        {
-          "description": "Enables the delete_branch command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-delete-branch"
-        },
-        {
-          "description": "Denies the delete_branch command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-delete-branch"
-        },
-        {
-          "description": "Enables the fetch_all command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-fetch-all"
-        },
-        {
-          "description": "Denies the fetch_all command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-fetch-all"
-        },
-        {
-          "description": "Enables the initialize command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-initialize"
-        },
-        {
-          "description": "Denies the initialize command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-initialize"
-        },
-        {
-          "description": "Enables the log command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-log"
-        },
-        {
-          "description": "Denies the log command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-log"
-        },
-        {
-          "description": "Enables the merge_branch command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-merge-branch"
-        },
-        {
-          "description": "Denies the merge_branch command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-merge-branch"
-        },
-        {
-          "description": "Enables the pull command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-pull"
-        },
-        {
-          "description": "Denies the pull command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-pull"
-        },
-        {
-          "description": "Enables the push command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-push"
-        },
-        {
-          "description": "Denies the push command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-push"
-        },
-        {
-          "description": "Enables the status command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-status"
-        },
-        {
-          "description": "Denies the status command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-status"
-        },
-        {
-          "description": "Enables the unstage command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-unstage"
-        },
-        {
-          "description": "Denies the unstage command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-unstage"
-        },
-        {
-          "description": "Default permissions for the plugin",
-          "type": "string",
-          "const": "default"
-        }
-      ]
-    }
-  }
-}

src-tauri/yaak-grpc/Cargo.toml

@@ -5,7 +5,7 @@ edition = "2024"
 publish = false
 
 [dependencies]
-anyhow = "1.0.79"
+anyhow = "1.0.97"
 async-recursion = "1.1.1"
 dunce = "1.0.4"
 hyper = "1.5.2"
@@ -18,11 +18,11 @@ md5 = "0.7.0"
 prost = "0.13.4"
 prost-reflect = { version = "0.14.4", default-features = false, features = ["serde", "derive"] }
 prost-types = "0.13.4"
-serde = { version = "1.0.196", features = ["derive"] }
-serde_json = "1.0.113"
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
 tauri = { workspace = true }
 tauri-plugin-shell = { workspace = true }
-tokio = { version = "1.0", features = ["macros", "rt-multi-thread", "fs"] }
+tokio = { workspace = true, features = ["macros", "rt-multi-thread", "fs"] }
 tokio-stream = "0.1.14"
 tonic = { version = "0.12.3", default-features = false, features = ["transport"] }
 tonic-reflection = "0.12.3"

src-tauri/yaak-license/Cargo.toml

@@ -9,8 +9,8 @@ publish = false
 chrono = "0.4.38"
 log = "0.4.26"
 reqwest = { workspace = true, features = ["json"] }
-serde = { version = "1.0.208", features = ["derive"] }
-serde_json = "1.0.132"
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
 tauri = { workspace = true }
 thiserror = { workspace = true }
 ts-rs = { workspace = true }

src-tauri/yaak-license/permissions/autogenerated/commands/activate.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-activate"
-description = "Enables the activate command without any pre-configured scope."
-commands.allow = ["activate"]
-
-[[permission]]
-identifier = "deny-activate"
-description = "Denies the activate command without any pre-configured scope."
-commands.deny = ["activate"]

src-tauri/yaak-license/permissions/autogenerated/commands/check.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-check"
-description = "Enables the check command without any pre-configured scope."
-commands.allow = ["check"]
-
-[[permission]]
-identifier = "deny-check"
-description = "Denies the check command without any pre-configured scope."
-commands.deny = ["check"]

src-tauri/yaak-license/permissions/autogenerated/commands/deactivate.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-deactivate"
-description = "Enables the deactivate command without any pre-configured scope."
-commands.allow = ["deactivate"]
-
-[[permission]]
-identifier = "deny-deactivate"
-description = "Denies the deactivate command without any pre-configured scope."
-commands.deny = ["deactivate"]

src-tauri/yaak-license/permissions/autogenerated/reference.md

@@ -1,95 +0,0 @@
-## Default Permission
-
-Default permissions for the plugin
-
-- `allow-check`
-- `allow-activate`
-- `allow-deactivate`
-
-## Permission Table
-
-<table>
-<tr>
-<th>Identifier</th>
-<th>Description</th>
-</tr>
-
-
-<tr>
-<td>
-
-`yaak-license:allow-activate`
-
-</td>
-<td>
-
-Enables the activate command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-license:deny-activate`
-
-</td>
-<td>
-
-Denies the activate command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-license:allow-check`
-
-</td>
-<td>
-
-Enables the check command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-license:deny-check`
-
-</td>
-<td>
-
-Denies the check command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-license:allow-deactivate`
-
-</td>
-<td>
-
-Enables the deactivate command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-license:deny-deactivate`
-
-</td>
-<td>
-
-Denies the deactivate command without any pre-configured scope.
-
-</td>
-</tr>
-</table>

src-tauri/yaak-license/permissions/schemas/schema.json

@@ -1,335 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "PermissionFile",
-  "description": "Permission file that can define a default permission, a set of permissions or a list of inlined permissions.",
-  "type": "object",
-  "properties": {
-    "default": {
-      "description": "The default permission set for the plugin",
-      "anyOf": [
-        {
-          "$ref": "#/definitions/DefaultPermission"
-        },
-        {
-          "type": "null"
-        }
-      ]
-    },
-    "set": {
-      "description": "A list of permissions sets defined",
-      "type": "array",
-      "items": {
-        "$ref": "#/definitions/PermissionSet"
-      }
-    },
-    "permission": {
-      "description": "A list of inlined permissions",
-      "default": [],
-      "type": "array",
-      "items": {
-        "$ref": "#/definitions/Permission"
-      }
-    }
-  },
-  "definitions": {
-    "DefaultPermission": {
-      "description": "The default permission set of the plugin.\n\nWorks similarly to a permission with the \"default\" identifier.",
-      "type": "object",
-      "required": [
-        "permissions"
-      ],
-      "properties": {
-        "version": {
-          "description": "The version of the permission.",
-          "type": [
-            "integer",
-            "null"
-          ],
-          "format": "uint64",
-          "minimum": 1.0
-        },
-        "description": {
-          "description": "Human-readable description of what the permission does. Tauri convention is to use `<h4>` headings in markdown content for Tauri documentation generation purposes.",
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "permissions": {
-          "description": "All permissions this set contains.",
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        }
-      }
-    },
-    "PermissionSet": {
-      "description": "A set of direct permissions grouped together under a new name.",
-      "type": "object",
-      "required": [
-        "description",
-        "identifier",
-        "permissions"
-      ],
-      "properties": {
-        "identifier": {
-          "description": "A unique identifier for the permission.",
-          "type": "string"
-        },
-        "description": {
-          "description": "Human-readable description of what the permission does.",
-          "type": "string"
-        },
-        "permissions": {
-          "description": "All permissions this set contains.",
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/PermissionKind"
-          }
-        }
-      }
-    },
-    "Permission": {
-      "description": "Descriptions of explicit privileges of commands.\n\nIt can enable commands to be accessible in the frontend of the application.\n\nIf the scope is defined it can be used to fine grain control the access of individual or multiple commands.",
-      "type": "object",
-      "required": [
-        "identifier"
-      ],
-      "properties": {
-        "version": {
-          "description": "The version of the permission.",
-          "type": [
-            "integer",
-            "null"
-          ],
-          "format": "uint64",
-          "minimum": 1.0
-        },
-        "identifier": {
-          "description": "A unique identifier for the permission.",
-          "type": "string"
-        },
-        "description": {
-          "description": "Human-readable description of what the permission does. Tauri internal convention is to use `<h4>` headings in markdown content for Tauri documentation generation purposes.",
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "commands": {
-          "description": "Allowed or denied commands when using this permission.",
-          "default": {
-            "allow": [],
-            "deny": []
-          },
-          "allOf": [
-            {
-              "$ref": "#/definitions/Commands"
-            }
-          ]
-        },
-        "scope": {
-          "description": "Allowed or denied scoped when using this permission.",
-          "allOf": [
-            {
-              "$ref": "#/definitions/Scopes"
-            }
-          ]
-        },
-        "platforms": {
-          "description": "Target platforms this permission applies. By default all platforms are affected by this permission.",
-          "type": [
-            "array",
-            "null"
-          ],
-          "items": {
-            "$ref": "#/definitions/Target"
-          }
-        }
-      }
-    },
-    "Commands": {
-      "description": "Allowed and denied commands inside a permission.\n\nIf two commands clash inside of `allow` and `deny`, it should be denied by default.",
-      "type": "object",
-      "properties": {
-        "allow": {
-          "description": "Allowed command.",
-          "default": [],
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        },
-        "deny": {
-          "description": "Denied command, which takes priority.",
-          "default": [],
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        }
-      }
-    },
-    "Scopes": {
-      "description": "An argument for fine grained behavior control of Tauri commands.\n\nIt can be of any serde serializable type and is used to allow or prevent certain actions inside a Tauri command. The configured scope is passed to the command and will be enforced by the command implementation.\n\n## Example\n\n```json { \"allow\": [{ \"path\": \"$HOME/**\" }], \"deny\": [{ \"path\": \"$HOME/secret.txt\" }] } ```",
-      "type": "object",
-      "properties": {
-        "allow": {
-          "description": "Data that defines what is allowed by the scope.",
-          "type": [
-            "array",
-            "null"
-          ],
-          "items": {
-            "$ref": "#/definitions/Value"
-          }
-        },
-        "deny": {
-          "description": "Data that defines what is denied by the scope. This should be prioritized by validation logic.",
-          "type": [
-            "array",
-            "null"
-          ],
-          "items": {
-            "$ref": "#/definitions/Value"
-          }
-        }
-      }
-    },
-    "Value": {
-      "description": "All supported ACL values.",
-      "anyOf": [
-        {
-          "description": "Represents a null JSON value.",
-          "type": "null"
-        },
-        {
-          "description": "Represents a [`bool`].",
-          "type": "boolean"
-        },
-        {
-          "description": "Represents a valid ACL [`Number`].",
-          "allOf": [
-            {
-              "$ref": "#/definitions/Number"
-            }
-          ]
-        },
-        {
-          "description": "Represents a [`String`].",
-          "type": "string"
-        },
-        {
-          "description": "Represents a list of other [`Value`]s.",
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/Value"
-          }
-        },
-        {
-          "description": "Represents a map of [`String`] keys to [`Value`]s.",
-          "type": "object",
-          "additionalProperties": {
-            "$ref": "#/definitions/Value"
-          }
-        }
-      ]
-    },
-    "Number": {
-      "description": "A valid ACL number.",
-      "anyOf": [
-        {
-          "description": "Represents an [`i64`].",
-          "type": "integer",
-          "format": "int64"
-        },
-        {
-          "description": "Represents a [`f64`].",
-          "type": "number",
-          "format": "double"
-        }
-      ]
-    },
-    "Target": {
-      "description": "Platform target.",
-      "oneOf": [
-        {
-          "description": "MacOS.",
-          "type": "string",
-          "enum": [
-            "macOS"
-          ]
-        },
-        {
-          "description": "Windows.",
-          "type": "string",
-          "enum": [
-            "windows"
-          ]
-        },
-        {
-          "description": "Linux.",
-          "type": "string",
-          "enum": [
-            "linux"
-          ]
-        },
-        {
-          "description": "Android.",
-          "type": "string",
-          "enum": [
-            "android"
-          ]
-        },
-        {
-          "description": "iOS.",
-          "type": "string",
-          "enum": [
-            "iOS"
-          ]
-        }
-      ]
-    },
-    "PermissionKind": {
-      "type": "string",
-      "oneOf": [
-        {
-          "description": "Enables the activate command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-activate"
-        },
-        {
-          "description": "Denies the activate command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-activate"
-        },
-        {
-          "description": "Enables the check command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-check"
-        },
-        {
-          "description": "Denies the check command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-check"
-        },
-        {
-          "description": "Enables the deactivate command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-deactivate"
-        },
-        {
-          "description": "Denies the deactivate command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-deactivate"
-        },
-        {
-          "description": "Default permissions for the plugin",
-          "type": "string",
-          "const": "default"
-        }
-      ]
-    }
-  }
-}

src-tauri/yaak-mac-window/Cargo.toml

@@ -0,0 +1,19 @@
+[package]
+name = "yaak-mac-window"
+links = "yaak-mac-window"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[build-dependencies]
+tauri-plugin = { workspace = true, features = ["build"] }
+
+[target.'cfg(target_os = "macos")'.dependencies]
+cocoa = "0.26.0"
+hex_color = "3.0.0"
+log = "0.4.27"
+objc = "0.2.7"
+rand = "0.9.0"
+
+[dependencies]
+tauri = { workspace = true }

src-tauri/yaak-mac-window/build.rs

@@ -0,0 +1,5 @@
+const COMMANDS: &[&str] = &["set_title", "set_theme"];
+
+fn main() {
+    tauri_plugin::Builder::new(COMMANDS).build();
+}

src-tauri/yaak-mac-window/index.ts

@@ -0,0 +1,9 @@
+import { invoke } from '@tauri-apps/api/core';
+
+export function setWindowTitle(title: string) {
+  invoke('plugin:yaak-mac-window|set_title', { title }).catch(console.error);
+}
+
+export function setWindowTheme(bgColor: string) {
+  invoke('plugin:yaak-mac-window|set_theme', { bgColor }).catch(console.error);
+}

src-tauri/yaak-mac-window/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "@yaakapp-internal/mac-window",
+  "private": true,
+  "version": "1.0.0",
+  "main": "index.ts"
+}

src-tauri/yaak-mac-window/permissions/default.toml

@@ -0,0 +1,6 @@
+[default]
+description = "Default permissions for the plugin"
+permissions = [
+    "allow-set-title",
+    "allow-set-theme",
+]

src-tauri/yaak-mac-window/src/commands.rs

@@ -0,0 +1,35 @@
+use tauri::{Runtime, Window, command};
+
+#[command]
+pub(crate) fn set_title<R: Runtime>(window: Window<R>, title: &str) {
+    #[cfg(target_os = "macos")]
+    {
+        crate::mac::update_window_title(window, title.to_string());
+    }
+
+    #[cfg(not(target_os = "macos"))]
+    {
+        let _ = window.set_title(title);
+    }
+}
+
+#[command]
+#[allow(unused)]
+pub(crate) fn set_theme<R: Runtime>(window: Window<R>, bg_color: &str) {
+    #[cfg(target_os = "macos")]
+    {
+        match hex_color::HexColor::parse_rgb(bg_color.trim()) {
+            Ok(color) => {
+                crate::mac::update_window_theme(window, color);
+            }
+            Err(err) => {
+                log::warn!("Failed to parse background color '{}': {}", bg_color, err)
+            }
+        }
+    }
+
+    #[cfg(not(target_os = "macos"))]
+    {
+        // Nothing yet for non-Mac platforms
+    }
+}

src-tauri/yaak-mac-window/src/lib.rs

@@ -0,0 +1,23 @@
+mod commands;
+
+#[cfg(target_os = "macos")]
+mod mac;
+
+use crate::commands::{set_theme, set_title};
+use tauri::{
+    Runtime, generate_handler,
+    plugin::{Builder, TauriPlugin},
+};
+
+pub fn init<R: Runtime>() -> TauriPlugin<R> {
+    #[allow(unused)]
+    Builder::new("yaak-mac-window")
+        .invoke_handler(generate_handler![set_title, set_theme])
+        .on_window_ready(|window| {
+            #[cfg(target_os = "macos")]
+            {
+                mac::setup_traffic_light_positioner(&window);
+            }
+        })
+        .build()
+}

src-tauri/yaak-mac-window/src/mac.rs

@@ -1,16 +1,6 @@
-use crate::window::MAIN_WINDOW_PREFIX;
 use hex_color::HexColor;
-use log::warn;
 use objc::{msg_send, sel, sel_impl};
-use rand::distr::Alphanumeric;
-use rand::Rng;
-use tauri::{
-    plugin::{Builder, TauriPlugin},
-    Emitter, Listener, Manager, Runtime, Window, WindowEvent,
-};
-
-const WINDOW_CONTROL_PAD_X: f64 = 13.0;
-const WINDOW_CONTROL_PAD_Y: f64 = 18.0;
+use tauri::{Emitter, Runtime, Window};
 
 struct UnsafeWindowHandle(*mut std::ffi::c_void);
 
@@ -18,65 +8,11 @@ unsafe impl Send for UnsafeWindowHandle {}
 
 unsafe impl Sync for UnsafeWindowHandle {}
 
-pub fn init<R: Runtime>() -> TauriPlugin<R> {
-    Builder::new("mac_window")
-        .on_window_ready(|window| {
-            #[cfg(target_os = "macos")]
-            {
-                setup_traffic_light_positioner(&window);
-                let h = window.app_handle();
+const WINDOW_CONTROL_PAD_X: f64 = 13.0;
+const WINDOW_CONTROL_PAD_Y: f64 = 18.0;
+const MAIN_WINDOW_PREFIX: &str = "main_";
 
-                let window_for_theme = window.clone();
-                let id1 = h.listen("yaak_bg_changed", move |ev| {
-                    let color_str: String = match serde_json::from_str(ev.payload()) {
-                        Ok(color) => color,
-                        Err(err) => {
-                            warn!("Failed to JSON parse color '{}': {}", ev.payload(), err);
-                            return;
-                        }
-                    };
-
-                    match HexColor::parse_rgb(color_str.trim()) {
-                        Ok(color) => {
-                            update_window_theme(window_for_theme.clone(), color);
-                        }
-                        Err(err) => {
-                            warn!("Failed to parse background color '{}': {}", color_str, err)
-                        }
-                    }
-                });
-
-                let window_for_title = window.clone();
-                let id2 = h.listen("yaak_title_changed", move |ev| {
-                    let title: String = match serde_json::from_str(ev.payload()) {
-                        Ok(title) => title,
-                        Err(err) => {
-                            warn!("Failed to parse window title \"{}\": {}", ev.payload(), err);
-                            return;
-                        }
-                    };
-
-                    update_window_title(window_for_title.clone(), title);
-                });
-
-                let h = h.clone();
-                window.on_window_event(move |e| {
-                    match e {
-                        WindowEvent::Destroyed => {
-                            h.unlisten(id1);
-                            h.unlisten(id2);
-                        }
-                        _ => {}
-                    };
-                });
-            }
-            return;
-        })
-        .build()
-}
-
-#[cfg(target_os = "macos")]
-fn update_window_title<R: Runtime>(window: Window<R>, title: String) {
+pub(crate) fn update_window_title<R: Runtime>(window: Window<R>, title: String) {
     use cocoa::{appkit::NSWindow, base::nil, foundation::NSString};
 
     unsafe {
@@ -98,8 +34,7 @@ fn update_window_title<R: Runtime>(window: Window<R>, title: String) {
     }
 }
 
-#[cfg(target_os = "macos")]
-fn update_window_theme<R: Runtime>(window: Window<R>, color: HexColor) {
+pub(crate) fn update_window_theme<R: Runtime>(window: Window<R>, color: HexColor) {
     use cocoa::appkit::{
         NSAppearance, NSAppearanceNameVibrantDark, NSAppearanceNameVibrantLight, NSWindow,
     };
@@ -130,8 +65,12 @@ fn update_window_theme<R: Runtime>(window: Window<R>, color: HexColor) {
     }
 }
 
-#[cfg(target_os = "macos")]
-fn position_traffic_lights(ns_window_handle: UnsafeWindowHandle, x: f64, y: f64, label: String) {
+fn position_traffic_lights(
+    ns_window_handle: UnsafeWindowHandle,
+    x: f64,
+    y: f64,
+    label: String,
+) {
     if !label.starts_with(MAIN_WINDOW_PREFIX) {
         return;
     }
@@ -140,6 +79,7 @@ fn position_traffic_lights(ns_window_handle: UnsafeWindowHandle, x: f64, y: f64,
     use cocoa::foundation::NSRect;
 
     let ns_window = ns_window_handle.0 as cocoa::base::id;
+    #[allow(unexpected_cfgs)]
     unsafe {
         let close = ns_window.standardWindowButton_(NSWindowButton::NSWindowCloseButton);
         let miniaturize =
@@ -168,19 +108,19 @@ fn position_traffic_lights(ns_window_handle: UnsafeWindowHandle, x: f64, y: f64,
     }
 }
 
-#[cfg(target_os = "macos")]
 #[derive(Debug)]
 struct WindowState<R: Runtime> {
     window: Window<R>,
 }
 
-#[cfg(target_os = "macos")]
 pub fn setup_traffic_light_positioner<R: Runtime>(window: &Window<R>) {
     use cocoa::appkit::NSWindow;
-    use cocoa::base::{id, BOOL};
+    use cocoa::base::{BOOL, id};
     use cocoa::delegate;
     use cocoa::foundation::NSUInteger;
     use objc::runtime::{Object, Sel};
+    use rand::Rng;
+    use rand::distr::Alphanumeric;
     use std::ffi::c_void;
 
     position_traffic_lights(
@@ -202,6 +142,7 @@ pub fn setup_traffic_light_positioner<R: Runtime>(window: &Window<R>) {
         func(ptr);
     }
 
+    #[allow(unexpected_cfgs)]
     unsafe {
         let ns_win =
             window.ns_window().expect("NS Window should exist to mount traffic light delegate.")
@@ -432,26 +373,26 @@ pub fn setup_traffic_light_positioner<R: Runtime>(window: &Window<R>) {
             app_box: *mut c_void = app_box,
             toolbar: id = cocoa::base::nil,
             super_delegate: id = current_delegate,
-            (windowShouldClose:) => on_window_should_close as extern fn(&Object, Sel, id) -> BOOL,
-            (windowWillClose:) => on_window_will_close as extern fn(&Object, Sel, id),
-            (windowDidResize:) => on_window_did_resize::<R> as extern fn(&Object, Sel, id),
-            (windowDidMove:) => on_window_did_move as extern fn(&Object, Sel, id),
-            (windowDidChangeBackingProperties:) => on_window_did_change_backing_properties as extern fn(&Object, Sel, id),
-            (windowDidBecomeKey:) => on_window_did_become_key as extern fn(&Object, Sel, id),
-            (windowDidResignKey:) => on_window_did_resign_key as extern fn(&Object, Sel, id),
-            (draggingEntered:) => on_dragging_entered as extern fn(&Object, Sel, id) -> BOOL,
-            (prepareForDragOperation:) => on_prepare_for_drag_operation as extern fn(&Object, Sel, id) -> BOOL,
-            (performDragOperation:) => on_perform_drag_operation as extern fn(&Object, Sel, id) -> BOOL,
-            (concludeDragOperation:) => on_conclude_drag_operation as extern fn(&Object, Sel, id),
-            (draggingExited:) => on_dragging_exited as extern fn(&Object, Sel, id),
-            (window:willUseFullScreenPresentationOptions:) => on_window_will_use_full_screen_presentation_options as extern fn(&Object, Sel, id, NSUInteger) -> NSUInteger,
-            (windowDidEnterFullScreen:) => on_window_did_enter_full_screen::<R> as extern fn(&Object, Sel, id),
-            (windowWillEnterFullScreen:) => on_window_will_enter_full_screen::<R> as extern fn(&Object, Sel, id),
-            (windowDidExitFullScreen:) => on_window_did_exit_full_screen::<R> as extern fn(&Object, Sel, id),
-            (windowWillExitFullScreen:) => on_window_will_exit_full_screen::<R> as extern fn(&Object, Sel, id),
-            (windowDidFailToEnterFullScreen:) => on_window_did_fail_to_enter_full_screen as extern fn(&Object, Sel, id),
-            (effectiveAppearanceDidChange:) => on_effective_appearance_did_change as extern fn(&Object, Sel, id),
-            (effectiveAppearanceDidChangedOnMainThread:) => on_effective_appearance_did_changed_on_main_thread as extern fn(&Object, Sel, id)
+            (windowShouldClose:) => on_window_should_close as extern "C" fn(&Object, Sel, id) -> BOOL,
+            (windowWillClose:) => on_window_will_close as extern "C" fn(&Object, Sel, id),
+            (windowDidResize:) => on_window_did_resize::<R> as extern "C" fn(&Object, Sel, id),
+            (windowDidMove:) => on_window_did_move as extern "C" fn(&Object, Sel, id),
+            (windowDidChangeBackingProperties:) => on_window_did_change_backing_properties as extern "C" fn(&Object, Sel, id),
+            (windowDidBecomeKey:) => on_window_did_become_key as extern "C" fn(&Object, Sel, id),
+            (windowDidResignKey:) => on_window_did_resign_key as extern "C" fn(&Object, Sel, id),
+            (draggingEntered:) => on_dragging_entered as extern "C" fn(&Object, Sel, id) -> BOOL,
+            (prepareForDragOperation:) => on_prepare_for_drag_operation as extern "C" fn(&Object, Sel, id) -> BOOL,
+            (performDragOperation:) => on_perform_drag_operation as extern "C" fn(&Object, Sel, id) -> BOOL,
+            (concludeDragOperation:) => on_conclude_drag_operation as extern "C" fn(&Object, Sel, id),
+            (draggingExited:) => on_dragging_exited as extern "C" fn(&Object, Sel, id),
+            (window:willUseFullScreenPresentationOptions:) => on_window_will_use_full_screen_presentation_options as extern "C" fn(&Object, Sel, id, NSUInteger) -> NSUInteger,
+            (windowDidEnterFullScreen:) => on_window_did_enter_full_screen::<R> as extern "C" fn(&Object, Sel, id),
+            (windowWillEnterFullScreen:) => on_window_will_enter_full_screen::<R> as extern "C" fn(&Object, Sel, id),
+            (windowDidExitFullScreen:) => on_window_did_exit_full_screen::<R> as extern "C" fn(&Object, Sel, id),
+            (windowWillExitFullScreen:) => on_window_will_exit_full_screen::<R> as extern "C" fn(&Object, Sel, id),
+            (windowDidFailToEnterFullScreen:) => on_window_did_fail_to_enter_full_screen as extern "C" fn(&Object, Sel, id),
+            (effectiveAppearanceDidChange:) => on_effective_appearance_did_change as extern "C" fn(&Object, Sel, id),
+            (effectiveAppearanceDidChangedOnMainThread:) => on_effective_appearance_did_changed_on_main_thread as extern "C" fn(&Object, Sel, id)
         }))
     }
 }

src-tauri/yaak-models/Cargo.toml

@@ -14,12 +14,12 @@ r2d2_sqlite = { version = "0.25.0" }
 rusqlite = { version = "0.32.1", features = ["bundled", "chrono"] }
 sea-query = { version = "0.32.1", features = ["with-chrono", "attr"] }
 sea-query-rusqlite = { version = "0.7.0", features = ["with-chrono"] }
-serde = { version = "1.0.204", features = ["derive"] }
-serde_json = "1.0.122"
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
 sqlx = { version = "0.8.0", default-features = false, features = ["migrate", "sqlite", "runtime-tokio-rustls"] }
 tauri = { workspace = true }
 thiserror = "2.0.11"
-tokio = "1.43.0"
+tokio = { workspace = true }
 ts-rs = { workspace = true, features = ["chrono-impl", "serde-json-impl"] }
 
 [build-dependencies]

src-tauri/yaak-models/bindings/gen_models.ts

@@ -12,6 +12,8 @@ export type CookieJar = { model: "cookie_jar", id: string, createdAt: string, up
 
 export type EditorKeymap = "default" | "vim" | "vscode" | "emacs";
 
+export type EncryptedKey = { encryptedKey: string, };
+
 export type Environment = { model: "environment", id: string, workspaceId: string, environmentId: string | null, createdAt: string, updatedAt: string, name: string, variables: Array<EnvironmentVariable>, };
 
 export type EnvironmentVariable = { enabled?: boolean, name: string, value: string, id?: string, };
@@ -56,11 +58,11 @@ export type ProxySetting = { "type": "enabled", http: string, https: string, aut
 
 export type ProxySettingAuth = { user: string, password: string, };
 
-export type Settings = { model: "settings", id: string, createdAt: string, updatedAt: string, appearance: string, editorFontSize: number, editorSoftWrap: boolean, interfaceFontSize: number, interfaceScale: number, openWorkspaceNewWindow: boolean | null, proxy: ProxySetting | null, theme: string, themeDark: string, themeLight: string, updateChannel: string, editorKeymap: EditorKeymap, };
+export type Settings = { model: "settings", id: string, createdAt: string, updatedAt: string, appearance: string, editorFontSize: number, editorSoftWrap: boolean, interfaceFontSize: number, interfaceScale: number, openWorkspaceNewWindow: boolean | null, proxy: ProxySetting | null, themeDark: string, themeLight: string, updateChannel: string, editorKeymap: EditorKeymap, };
 
 export type SyncState = { model: "sync_state", id: string, workspaceId: string, createdAt: string, updatedAt: string, flushedAt: string, modelId: string, checksum: string, relPath: string, syncDir: string, };
 
-export type UpdateSource = { "type": "sync" } | { "type": "window", label: string, } | { "type": "plugin" } | { "type": "background" } | { "type": "import" };
+export type UpdateSource = { "type": "background" } | { "type": "import" } | { "type": "plugin" } | { "type": "sync" } | { "type": "window", label: string, };
 
 export type WebsocketConnection = { model: "websocket_connection", id: string, createdAt: string, updatedAt: string, workspaceId: string, requestId: string, elapsed: number, error: string | null, headers: Array<HttpResponseHeader>, state: WebsocketConnectionState, status: number, url: string, };
 
@@ -74,6 +76,6 @@ export type WebsocketMessageType = "text" | "binary";
 
 export type WebsocketRequest = { model: "websocket_request", id: string, createdAt: string, updatedAt: string, workspaceId: string, folderId: string | null, authentication: Record<string, any>, authenticationType: string | null, description: string, headers: Array<HttpRequestHeader>, message: string, name: string, sortPriority: number, url: string, urlParameters: Array<HttpUrlParameter>, };
 
-export type Workspace = { model: "workspace", id: string, createdAt: string, updatedAt: string, name: string, description: string, settingValidateCertificates: boolean, settingFollowRedirects: boolean, settingRequestTimeout: number, };
+export type Workspace = { model: "workspace", id: string, createdAt: string, updatedAt: string, name: string, description: string, encryptionKeyChallenge: string | null, settingValidateCertificates: boolean, settingFollowRedirects: boolean, settingRequestTimeout: number, };
 
-export type WorkspaceMeta = { model: "workspace_meta", id: string, workspaceId: string, createdAt: string, updatedAt: string, settingSyncDir: string | null, };
+export type WorkspaceMeta = { model: "workspace_meta", id: string, workspaceId: string, createdAt: string, updatedAt: string, encryptionKey: EncryptedKey | null, settingSyncDir: string | null, };

src-tauri/yaak-models/bindings/gen_util.ts

@@ -0,0 +1,9 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { Environment } from "./gen_models.js";
+import type { Folder } from "./gen_models.js";
+import type { GrpcRequest } from "./gen_models.js";
+import type { HttpRequest } from "./gen_models.js";
+import type { WebsocketRequest } from "./gen_models.js";
+import type { Workspace } from "./gen_models.js";
+
+export type BatchUpsertResult = { workspaces: Array<Workspace>, environments: Array<Environment>, folders: Array<Folder>, httpRequests: Array<HttpRequest>, grpcRequests: Array<GrpcRequest>, websocketRequests: Array<WebsocketRequest>, };

src-tauri/yaak-models/guest-js/index.ts

@@ -1,6 +1,7 @@
 import { AnyModel } from '../bindings/gen_models';
 
 export * from '../bindings/gen_models';
+export * from '../bindings/gen_util';
 export * from './store';
 export * from './atoms';
 

src-tauri/yaak-models/guest-js/store.ts

@@ -102,7 +102,7 @@ export function patchModelById<M extends AnyModel['model'], T extends ExtractMod
   }
 
   const newModel = typeof patch === 'function' ? patch(prev) : { ...prev, ...patch };
-  return invoke<string>('plugin:yaak-models|upsert', { model: newModel });
+  return updateModel(newModel);
 }
 
 export async function patchModel<M extends AnyModel['model'], T extends ExtractModel<AnyModel, M>>(
@@ -112,6 +112,12 @@ export async function patchModel<M extends AnyModel['model'], T extends ExtractM
   return patchModelById<M, T>(base.model, base.id, patch);
 }
 
+export async function updateModel<M extends AnyModel['model'], T extends ExtractModel<AnyModel, M>>(
+  model: T,
+): Promise<string> {
+  return invoke<string>('plugin:yaak-models|upsert', { model });
+}
+
 export async function deleteModelById<
   M extends AnyModel['model'],
   T extends ExtractModel<AnyModel, M>,

src-tauri/yaak-models/permissions/autogenerated/commands/delete.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-delete"
-description = "Enables the delete command without any pre-configured scope."
-commands.allow = ["delete"]
-
-[[permission]]
-identifier = "deny-delete"
-description = "Denies the delete command without any pre-configured scope."
-commands.deny = ["delete"]

src-tauri/yaak-models/permissions/autogenerated/commands/duplicate.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-duplicate"
-description = "Enables the duplicate command without any pre-configured scope."
-commands.allow = ["duplicate"]
-
-[[permission]]
-identifier = "deny-duplicate"
-description = "Denies the duplicate command without any pre-configured scope."
-commands.deny = ["duplicate"]

src-tauri/yaak-models/permissions/autogenerated/commands/get_settings.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-get-settings"
-description = "Enables the get_settings command without any pre-configured scope."
-commands.allow = ["get_settings"]
-
-[[permission]]
-identifier = "deny-get-settings"
-description = "Denies the get_settings command without any pre-configured scope."
-commands.deny = ["get_settings"]

src-tauri/yaak-models/permissions/autogenerated/commands/grpc_events.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-grpc-events"
-description = "Enables the grpc_events command without any pre-configured scope."
-commands.allow = ["grpc_events"]
-
-[[permission]]
-identifier = "deny-grpc-events"
-description = "Denies the grpc_events command without any pre-configured scope."
-commands.deny = ["grpc_events"]

src-tauri/yaak-models/permissions/autogenerated/commands/upsert.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-upsert"
-description = "Enables the upsert command without any pre-configured scope."
-commands.allow = ["upsert"]
-
-[[permission]]
-identifier = "deny-upsert"
-description = "Denies the upsert command without any pre-configured scope."
-commands.deny = ["upsert"]

src-tauri/yaak-models/permissions/autogenerated/commands/websocket_events.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-websocket-events"
-description = "Enables the websocket_events command without any pre-configured scope."
-commands.allow = ["websocket_events"]
-
-[[permission]]
-identifier = "deny-websocket-events"
-description = "Denies the websocket_events command without any pre-configured scope."
-commands.deny = ["websocket_events"]

src-tauri/yaak-models/permissions/autogenerated/commands/workspace_models.toml

@@ -1,13 +0,0 @@
-# Automatically generated - DO NOT EDIT!
-
-"$schema" = "../../schemas/schema.json"
-
-[[permission]]
-identifier = "allow-workspace-models"
-description = "Enables the workspace_models command without any pre-configured scope."
-commands.allow = ["workspace_models"]
-
-[[permission]]
-identifier = "deny-workspace-models"
-description = "Denies the workspace_models command without any pre-configured scope."
-commands.deny = ["workspace_models"]

src-tauri/yaak-models/permissions/autogenerated/reference.md

@@ -1,203 +0,0 @@
-## Default Permission
-
-Default permissions for the plugin
-
-- `allow-delete`
-- `allow-duplicate`
-- `allow-get-settings`
-- `allow-grpc-events`
-- `allow-upsert`
-- `allow-websocket-events`
-- `allow-workspace-models`
-
-## Permission Table
-
-<table>
-<tr>
-<th>Identifier</th>
-<th>Description</th>
-</tr>
-
-
-<tr>
-<td>
-
-`yaak-models:allow-delete`
-
-</td>
-<td>
-
-Enables the delete command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-models:deny-delete`
-
-</td>
-<td>
-
-Denies the delete command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-models:allow-duplicate`
-
-</td>
-<td>
-
-Enables the duplicate command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-models:deny-duplicate`
-
-</td>
-<td>
-
-Denies the duplicate command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-models:allow-get-settings`
-
-</td>
-<td>
-
-Enables the get_settings command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-models:deny-get-settings`
-
-</td>
-<td>
-
-Denies the get_settings command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-models:allow-grpc-events`
-
-</td>
-<td>
-
-Enables the grpc_events command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-models:deny-grpc-events`
-
-</td>
-<td>
-
-Denies the grpc_events command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-models:allow-upsert`
-
-</td>
-<td>
-
-Enables the upsert command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-models:deny-upsert`
-
-</td>
-<td>
-
-Denies the upsert command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-models:allow-websocket-events`
-
-</td>
-<td>
-
-Enables the websocket_events command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-models:deny-websocket-events`
-
-</td>
-<td>
-
-Denies the websocket_events command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-models:allow-workspace-models`
-
-</td>
-<td>
-
-Enables the workspace_models command without any pre-configured scope.
-
-</td>
-</tr>
-
-<tr>
-<td>
-
-`yaak-models:deny-workspace-models`
-
-</td>
-<td>
-
-Denies the workspace_models command without any pre-configured scope.
-
-</td>
-</tr>
-</table>

src-tauri/yaak-models/permissions/schemas/schema.json

@@ -1,375 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "PermissionFile",
-  "description": "Permission file that can define a default permission, a set of permissions or a list of inlined permissions.",
-  "type": "object",
-  "properties": {
-    "default": {
-      "description": "The default permission set for the plugin",
-      "anyOf": [
-        {
-          "$ref": "#/definitions/DefaultPermission"
-        },
-        {
-          "type": "null"
-        }
-      ]
-    },
-    "set": {
-      "description": "A list of permissions sets defined",
-      "type": "array",
-      "items": {
-        "$ref": "#/definitions/PermissionSet"
-      }
-    },
-    "permission": {
-      "description": "A list of inlined permissions",
-      "default": [],
-      "type": "array",
-      "items": {
-        "$ref": "#/definitions/Permission"
-      }
-    }
-  },
-  "definitions": {
-    "DefaultPermission": {
-      "description": "The default permission set of the plugin.\n\nWorks similarly to a permission with the \"default\" identifier.",
-      "type": "object",
-      "required": [
-        "permissions"
-      ],
-      "properties": {
-        "version": {
-          "description": "The version of the permission.",
-          "type": [
-            "integer",
-            "null"
-          ],
-          "format": "uint64",
-          "minimum": 1.0
-        },
-        "description": {
-          "description": "Human-readable description of what the permission does. Tauri convention is to use `<h4>` headings in markdown content for Tauri documentation generation purposes.",
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "permissions": {
-          "description": "All permissions this set contains.",
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        }
-      }
-    },
-    "PermissionSet": {
-      "description": "A set of direct permissions grouped together under a new name.",
-      "type": "object",
-      "required": [
-        "description",
-        "identifier",
-        "permissions"
-      ],
-      "properties": {
-        "identifier": {
-          "description": "A unique identifier for the permission.",
-          "type": "string"
-        },
-        "description": {
-          "description": "Human-readable description of what the permission does.",
-          "type": "string"
-        },
-        "permissions": {
-          "description": "All permissions this set contains.",
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/PermissionKind"
-          }
-        }
-      }
-    },
-    "Permission": {
-      "description": "Descriptions of explicit privileges of commands.\n\nIt can enable commands to be accessible in the frontend of the application.\n\nIf the scope is defined it can be used to fine grain control the access of individual or multiple commands.",
-      "type": "object",
-      "required": [
-        "identifier"
-      ],
-      "properties": {
-        "version": {
-          "description": "The version of the permission.",
-          "type": [
-            "integer",
-            "null"
-          ],
-          "format": "uint64",
-          "minimum": 1.0
-        },
-        "identifier": {
-          "description": "A unique identifier for the permission.",
-          "type": "string"
-        },
-        "description": {
-          "description": "Human-readable description of what the permission does. Tauri internal convention is to use `<h4>` headings in markdown content for Tauri documentation generation purposes.",
-          "type": [
-            "string",
-            "null"
-          ]
-        },
-        "commands": {
-          "description": "Allowed or denied commands when using this permission.",
-          "default": {
-            "allow": [],
-            "deny": []
-          },
-          "allOf": [
-            {
-              "$ref": "#/definitions/Commands"
-            }
-          ]
-        },
-        "scope": {
-          "description": "Allowed or denied scoped when using this permission.",
-          "allOf": [
-            {
-              "$ref": "#/definitions/Scopes"
-            }
-          ]
-        },
-        "platforms": {
-          "description": "Target platforms this permission applies. By default all platforms are affected by this permission.",
-          "type": [
-            "array",
-            "null"
-          ],
-          "items": {
-            "$ref": "#/definitions/Target"
-          }
-        }
-      }
-    },
-    "Commands": {
-      "description": "Allowed and denied commands inside a permission.\n\nIf two commands clash inside of `allow` and `deny`, it should be denied by default.",
-      "type": "object",
-      "properties": {
-        "allow": {
-          "description": "Allowed command.",
-          "default": [],
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        },
-        "deny": {
-          "description": "Denied command, which takes priority.",
-          "default": [],
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        }
-      }
-    },
-    "Scopes": {
-      "description": "An argument for fine grained behavior control of Tauri commands.\n\nIt can be of any serde serializable type and is used to allow or prevent certain actions inside a Tauri command. The configured scope is passed to the command and will be enforced by the command implementation.\n\n## Example\n\n```json { \"allow\": [{ \"path\": \"$HOME/**\" }], \"deny\": [{ \"path\": \"$HOME/secret.txt\" }] } ```",
-      "type": "object",
-      "properties": {
-        "allow": {
-          "description": "Data that defines what is allowed by the scope.",
-          "type": [
-            "array",
-            "null"
-          ],
-          "items": {
-            "$ref": "#/definitions/Value"
-          }
-        },
-        "deny": {
-          "description": "Data that defines what is denied by the scope. This should be prioritized by validation logic.",
-          "type": [
-            "array",
-            "null"
-          ],
-          "items": {
-            "$ref": "#/definitions/Value"
-          }
-        }
-      }
-    },
-    "Value": {
-      "description": "All supported ACL values.",
-      "anyOf": [
-        {
-          "description": "Represents a null JSON value.",
-          "type": "null"
-        },
-        {
-          "description": "Represents a [`bool`].",
-          "type": "boolean"
-        },
-        {
-          "description": "Represents a valid ACL [`Number`].",
-          "allOf": [
-            {
-              "$ref": "#/definitions/Number"
-            }
-          ]
-        },
-        {
-          "description": "Represents a [`String`].",
-          "type": "string"
-        },
-        {
-          "description": "Represents a list of other [`Value`]s.",
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/Value"
-          }
-        },
-        {
-          "description": "Represents a map of [`String`] keys to [`Value`]s.",
-          "type": "object",
-          "additionalProperties": {
-            "$ref": "#/definitions/Value"
-          }
-        }
-      ]
-    },
-    "Number": {
-      "description": "A valid ACL number.",
-      "anyOf": [
-        {
-          "description": "Represents an [`i64`].",
-          "type": "integer",
-          "format": "int64"
-        },
-        {
-          "description": "Represents a [`f64`].",
-          "type": "number",
-          "format": "double"
-        }
-      ]
-    },
-    "Target": {
-      "description": "Platform target.",
-      "oneOf": [
-        {
-          "description": "MacOS.",
-          "type": "string",
-          "enum": [
-            "macOS"
-          ]
-        },
-        {
-          "description": "Windows.",
-          "type": "string",
-          "enum": [
-            "windows"
-          ]
-        },
-        {
-          "description": "Linux.",
-          "type": "string",
-          "enum": [
-            "linux"
-          ]
-        },
-        {
-          "description": "Android.",
-          "type": "string",
-          "enum": [
-            "android"
-          ]
-        },
-        {
-          "description": "iOS.",
-          "type": "string",
-          "enum": [
-            "iOS"
-          ]
-        }
-      ]
-    },
-    "PermissionKind": {
-      "type": "string",
-      "oneOf": [
-        {
-          "description": "Enables the delete command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-delete"
-        },
-        {
-          "description": "Denies the delete command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-delete"
-        },
-        {
-          "description": "Enables the duplicate command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-duplicate"
-        },
-        {
-          "description": "Denies the duplicate command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-duplicate"
-        },
-        {
-          "description": "Enables the get_settings command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-get-settings"
-        },
-        {
-          "description": "Denies the get_settings command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-get-settings"
-        },
-        {
-          "description": "Enables the grpc_events command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-grpc-events"
-        },
-        {
-          "description": "Denies the grpc_events command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-grpc-events"
-        },
-        {
-          "description": "Enables the upsert command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-upsert"
-        },
-        {
-          "description": "Denies the upsert command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-upsert"
-        },
-        {
-          "description": "Enables the websocket_events command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-websocket-events"
-        },
-        {
-          "description": "Denies the websocket_events command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-websocket-events"
-        },
-        {
-          "description": "Enables the workspace_models command without any pre-configured scope.",
-          "type": "string",
-          "const": "allow-workspace-models"
-        },
-        {
-          "description": "Denies the workspace_models command without any pre-configured scope.",
-          "type": "string",
-          "const": "deny-workspace-models"
-        },
-        {
-          "description": "Default permissions for the plugin",
-          "type": "string",
-          "const": "default"
-        }
-      ]
-    }
-  }
-}

src-tauri/yaak-models/src/db_context.rs

@@ -53,9 +53,11 @@ impl<'a> DbContext<'a> {
     where
         M: Into<AnyModel> + Clone + UpsertModelInfo,
     {
+        let (order_by_col, order_by_dir) = M::order_by();
         let (sql, params) = Query::select()
             .from(M::table_name())
             .column(Asterisk)
+            .order_by(order_by_col, order_by_dir)
             .build_rusqlite(SqliteQueryBuilder);
         let mut stmt = self.conn.resolve().prepare(sql.as_str())?;
         let items = stmt.query_map(&*params.as_params(), M::from_row)?;
@@ -72,18 +74,21 @@ impl<'a> DbContext<'a> {
         M: Into<AnyModel> + Clone + UpsertModelInfo,
     {
         // TODO: Figure out how to do this conditional builder better
+        let (order_by_col, order_by_dir) = M::order_by();
         let (sql, params) = if let Some(limit) = limit {
             Query::select()
                 .from(M::table_name())
                 .column(Asterisk)
                 .cond_where(Expr::col(col).eq(value))
                 .limit(limit)
+                .order_by(order_by_col, order_by_dir)
                 .build_rusqlite(SqliteQueryBuilder)
         } else {
             Query::select()
                 .from(M::table_name())
                 .column(Asterisk)
                 .cond_where(Expr::col(col).eq(value))
+                .order_by(order_by_col, order_by_dir)
                 .build_rusqlite(SqliteQueryBuilder)
         };
 

src-tauri/yaak-models/src/error.rs

@@ -20,7 +20,7 @@ pub enum Error {
 
     #[error("Model error: {0}")]
     GenericError(String),
-    
+
     #[error("Row not found")]
     RowNotFound,
 

src-tauri/yaak-models/src/lib.rs

@@ -20,7 +20,7 @@ use tokio::sync::mpsc;
 mod commands;
 
 mod connection_or_tx;
-mod db_context;
+pub mod db_context;
 pub mod error;
 pub mod models;
 pub mod queries;

src-tauri/yaak-models/src/models.rs

@@ -3,10 +3,11 @@ use crate::models::HttpRequestIden::{
     Authentication, AuthenticationType, Body, BodyType, CreatedAt, Description, FolderId, Headers,
     Method, Name, SortPriority, UpdatedAt, Url, UrlParameters, WorkspaceId,
 };
-use crate::util::{generate_prefixed_id, UpdateSource};
+use crate::util::{UpdateSource, generate_prefixed_id};
 use chrono::{NaiveDateTime, Utc};
 use rusqlite::Row;
-use sea_query::{enum_def, IntoIden, IntoTableRef, SimpleExpr};
+use sea_query::Order::Desc;
+use sea_query::{IntoColumnRef, IntoIden, IntoTableRef, Order, SimpleExpr, enum_def};
 use serde::{Deserialize, Deserializer, Serialize};
 use serde_json::Value;
 use std::collections::BTreeMap;
@@ -124,6 +125,10 @@ impl UpsertModelInfo for Settings {
         panic!("Settings does not have unique IDs")
     }
 
+    fn order_by() -> (impl IntoColumnRef, Order) {
+        (SettingsIden::CreatedAt, Desc)
+    }
+
     fn get_id(&self) -> String {
         self.id.clone()
     }
@@ -209,6 +214,7 @@ pub struct Workspace {
     pub updated_at: NaiveDateTime,
     pub name: String,
     pub description: String,
+    pub encryption_key_challenge: Option<String>,
 
     // Settings
     #[serde(default = "default_true")]
@@ -231,6 +237,10 @@ impl UpsertModelInfo for Workspace {
         generate_prefixed_id("wk")
     }
 
+    fn order_by() -> (impl IntoColumnRef, Order) {
+        (WorkspaceIden::CreatedAt, Desc)
+    }
+
     fn get_id(&self) -> String {
         self.id.clone()
     }
@@ -245,6 +255,7 @@ impl UpsertModelInfo for Workspace {
             (UpdatedAt, upsert_date(source, self.updated_at)),
             (Name, self.name.trim().into()),
             (Description, self.description.into()),
+            (EncryptionKeyChallenge, self.encryption_key_challenge.into()),
             (SettingFollowRedirects, self.setting_follow_redirects.into()),
             (SettingRequestTimeout, self.setting_request_timeout.into()),
             (SettingValidateCertificates, self.setting_validate_certificates.into()),
@@ -256,6 +267,7 @@ impl UpsertModelInfo for Workspace {
             WorkspaceIden::UpdatedAt,
             WorkspaceIden::Name,
             WorkspaceIden::Description,
+            WorkspaceIden::EncryptionKeyChallenge,
             WorkspaceIden::SettingRequestTimeout,
             WorkspaceIden::SettingFollowRedirects,
             WorkspaceIden::SettingRequestTimeout,
@@ -274,6 +286,7 @@ impl UpsertModelInfo for Workspace {
             updated_at: row.get("updated_at")?,
             name: row.get("name")?,
             description: row.get("description")?,
+            encryption_key_challenge: row.get("encryption_key_challenge")?,
             setting_follow_redirects: row.get("setting_follow_redirects")?,
             setting_request_timeout: row.get("setting_request_timeout")?,
             setting_validate_certificates: row.get("setting_validate_certificates")?,
@@ -281,16 +294,11 @@ impl UpsertModelInfo for Workspace {
     }
 }
 
-impl Workspace {
-    pub fn new(name: String) -> Self {
-        Self {
-            name,
-            model: "workspace".to_string(),
-            setting_validate_certificates: true,
-            setting_follow_redirects: true,
-            ..Default::default()
-        }
-    }
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, TS)]
+#[serde(default, rename_all = "camelCase")]
+#[ts(export, export_to = "gen_models.ts")]
+pub struct EncryptedKey {
+    pub encrypted_key: String,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, Default, TS)]
@@ -304,6 +312,7 @@ pub struct WorkspaceMeta {
     pub workspace_id: String,
     pub created_at: NaiveDateTime,
     pub updated_at: NaiveDateTime,
+    pub encryption_key: Option<EncryptedKey>,
     pub setting_sync_dir: Option<String>,
 }
 
@@ -320,6 +329,10 @@ impl UpsertModelInfo for WorkspaceMeta {
         generate_prefixed_id("wm")
     }
 
+    fn order_by() -> (impl IntoColumnRef, Order) {
+        (WorkspaceMetaIden::CreatedAt, Desc)
+    }
+
     fn get_id(&self) -> String {
         self.id.clone()
     }
@@ -333,6 +346,7 @@ impl UpsertModelInfo for WorkspaceMeta {
             (CreatedAt, upsert_date(source, self.created_at)),
             (UpdatedAt, upsert_date(source, self.updated_at)),
             (WorkspaceId, self.workspace_id.into()),
+            (EncryptionKey, self.encryption_key.map(|e| serde_json::to_string(&e).unwrap()).into()),
             (SettingSyncDir, self.setting_sync_dir.into()),
         ])
     }
@@ -340,6 +354,7 @@ impl UpsertModelInfo for WorkspaceMeta {
     fn update_columns() -> Vec<impl IntoIden> {
         vec![
             WorkspaceMetaIden::UpdatedAt,
+            WorkspaceMetaIden::EncryptionKey,
             WorkspaceMetaIden::SettingSyncDir,
         ]
     }
@@ -348,12 +363,14 @@ impl UpsertModelInfo for WorkspaceMeta {
     where
         Self: Sized,
     {
+        let encryption_key: Option<String> = row.get("encryption_key")?;
         Ok(Self {
             id: row.get("id")?,
             workspace_id: row.get("workspace_id")?,
             model: row.get("model")?,
             created_at: row.get("created_at")?,
             updated_at: row.get("updated_at")?,
+            encryption_key: encryption_key.map(|e| serde_json::from_str(&e).unwrap()),
             setting_sync_dir: row.get("setting_sync_dir")?,
         })
     }
@@ -413,6 +430,10 @@ impl UpsertModelInfo for CookieJar {
         generate_prefixed_id("cj")
     }
 
+    fn order_by() -> (impl IntoColumnRef, Order) {
+        (CookieJarIden::CreatedAt, Desc)
+    }
+
     fn get_id(&self) -> String {
         self.id.clone()
     }
@@ -486,6 +507,10 @@ impl UpsertModelInfo for Environment {
         generate_prefixed_id("ev")
     }
 
+    fn order_by() -> (impl IntoColumnRef, Order) {
+        (EnvironmentIden::CreatedAt, Desc)
+    }
+
     fn get_id(&self) -> String {
         self.id.clone()
     }
@@ -575,6 +600,10 @@ impl UpsertModelInfo for Folder {
         generate_prefixed_id("fl")
     }
 
+    fn order_by() -> (impl IntoColumnRef, Order) {
+        (FolderIden::CreatedAt, Desc)
+    }
+
     fn get_id(&self) -> String {
         self.id.clone()
     }
@@ -673,7 +702,7 @@ pub struct HttpRequest {
     #[serde(default = "default_http_method")]
     pub method: String,
     pub name: String,
-    pub sort_priority: f32,
+    pub sort_priority: f64,
     pub url: String,
     pub url_parameters: Vec<HttpUrlParameter>,
 }
@@ -691,6 +720,10 @@ impl UpsertModelInfo for HttpRequest {
         generate_prefixed_id("rq")
     }
 
+    fn order_by() -> (impl IntoColumnRef, Order) {
+        (HttpResponseIden::CreatedAt, Desc)
+    }
+
     fn get_id(&self) -> String {
         self.id.to_string()
     }
@@ -745,21 +778,21 @@ impl UpsertModelInfo for HttpRequest {
         Ok(Self {
             id: r.get("id")?,
             model: r.get("model")?,
-            sort_priority: r.get("sort_priority")?,
             workspace_id: r.get("workspace_id")?,
             created_at: r.get("created_at")?,
             updated_at: r.get("updated_at")?,
-            url: r.get("url")?,
-            url_parameters: serde_json::from_str(url_parameters.as_str()).unwrap_or_default(),
-            method: r.get("method")?,
+            authentication: serde_json::from_str(authentication.as_str()).unwrap_or_default(),
+            authentication_type: r.get("authentication_type")?,
             body: serde_json::from_str(body.as_str()).unwrap_or_default(),
             body_type: r.get("body_type")?,
             description: r.get("description")?,
-            authentication: serde_json::from_str(authentication.as_str()).unwrap_or_default(),
-            authentication_type: r.get("authentication_type")?,
-            headers: serde_json::from_str(headers.as_str()).unwrap_or_default(),
             folder_id: r.get("folder_id")?,
+            headers: serde_json::from_str(headers.as_str()).unwrap_or_default(),
+            method: r.get("method")?,
             name: r.get("name")?,
+            sort_priority: r.get("sort_priority")?,
+            url: r.get("url")?,
+            url_parameters: serde_json::from_str(url_parameters.as_str()).unwrap_or_default(),
         })
     }
 }
@@ -814,6 +847,10 @@ impl UpsertModelInfo for WebsocketConnection {
         generate_prefixed_id("wc")
     }
 
+    fn order_by() -> (impl IntoColumnRef, Order) {
+        (WebsocketConnectionIden::CreatedAt, Desc)
+    }
+
     fn get_id(&self) -> String {
         self.id.clone()
     }
@@ -924,6 +961,10 @@ impl UpsertModelInfo for WebsocketRequest {
         generate_prefixed_id("wr")
     }
 
+    fn order_by() -> (impl IntoColumnRef, Order) {
+        (WebsocketRequestIden::CreatedAt, Desc)
+    }
+
     fn get_id(&self) -> String {
         self.id.clone()
     }
@@ -1045,6 +1086,10 @@ impl UpsertModelInfo for WebsocketEvent {
         generate_prefixed_id("we")
     }
 
+    fn order_by() -> (impl IntoColumnRef, Order) {
+        (WebsocketEventIden::CreatedAt, Desc)
+    }
+
     fn get_id(&self) -> String {
         self.id.clone()
     }
@@ -1158,6 +1203,10 @@ impl UpsertModelInfo for HttpResponse {
         generate_prefixed_id("rs")
     }
 
+    fn order_by() -> (impl IntoColumnRef, Order) {
+        (HttpResponseIden::CreatedAt, Desc)
+    }
+
     fn get_id(&self) -> String {
         self.id.clone()
     }
@@ -1286,6 +1335,10 @@ impl UpsertModelInfo for GrpcRequest {
         generate_prefixed_id("gr")
     }
 
+    fn order_by() -> (impl IntoColumnRef, Order) {
+        (GrpcRequestIden::CreatedAt, Desc)
+    }
+
     fn get_id(&self) -> String {
         self.id.clone()
     }
@@ -1409,6 +1462,10 @@ impl UpsertModelInfo for GrpcConnection {
         generate_prefixed_id("gc")
     }
 
+    fn order_by() -> (impl IntoColumnRef, Order) {
+        (GrpcConnectionIden::CreatedAt, Desc)
+    }
+
     fn get_id(&self) -> String {
         self.id.clone()
     }
@@ -1525,6 +1582,10 @@ impl UpsertModelInfo for GrpcEvent {
         generate_prefixed_id("ge")
     }
 
+    fn order_by() -> (impl IntoColumnRef, Order) {
+        (GrpcEventIden::CreatedAt, Desc)
+    }
+
     fn get_id(&self) -> String {
         self.id.clone()
     }
@@ -1612,6 +1673,10 @@ impl UpsertModelInfo for Plugin {
         generate_prefixed_id("pg")
     }
 
+    fn order_by() -> (impl IntoColumnRef, Order) {
+        (PluginIden::CreatedAt, Desc)
+    }
+
     fn get_id(&self) -> String {
         self.id.clone()
     }
@@ -1690,6 +1755,10 @@ impl UpsertModelInfo for SyncState {
         generate_prefixed_id("ss")
     }
 
+    fn order_by() -> (impl IntoColumnRef, Order) {
+        (SyncStateIden::CreatedAt, Desc)
+    }
+
     fn get_id(&self) -> String {
         self.id.clone()
     }
@@ -1769,6 +1838,10 @@ impl UpsertModelInfo for KeyValue {
         generate_prefixed_id("kv")
     }
 
+    fn order_by() -> (impl IntoColumnRef, Order) {
+        (KeyValueIden::CreatedAt, Desc)
+    }
+
     fn get_id(&self) -> String {
         self.id.clone()
     }
@@ -1919,13 +1992,18 @@ impl<'de> Deserialize<'de> for AnyModel {
             Some(m) if m == "key_value" => AnyModel::KeyValue(fv(value).unwrap()),
             Some(m) if m == "plugin" => AnyModel::Plugin(fv(value).unwrap()),
             Some(m) if m == "settings" => AnyModel::Settings(fv(value).unwrap()),
-            Some(m) if m == "websocket_connection" => AnyModel::WebsocketConnection(fv(value).unwrap()),
+            Some(m) if m == "websocket_connection" => {
+                AnyModel::WebsocketConnection(fv(value).unwrap())
+            }
             Some(m) if m == "websocket_event" => AnyModel::WebsocketEvent(fv(value).unwrap()),
             Some(m) if m == "websocket_request" => AnyModel::WebsocketRequest(fv(value).unwrap()),
             Some(m) if m == "workspace" => AnyModel::Workspace(fv(value).unwrap()),
             Some(m) if m == "workspace_meta" => AnyModel::WorkspaceMeta(fv(value).unwrap()),
             Some(m) => {
-                return Err(serde::de::Error::custom(format!("Failed to deserialize AnyModel {}", m)));
+                return Err(serde::de::Error::custom(format!(
+                    "Failed to deserialize AnyModel {}",
+                    m
+                )));
             }
             None => {
                 return Err(serde::de::Error::custom("Missing or invalid model"));
@@ -1963,6 +2041,7 @@ pub trait UpsertModelInfo {
     fn table_name() -> impl IntoTableRef;
     fn id_column() -> impl IntoIden + Eq + Clone;
     fn generate_id() -> String;
+    fn order_by() -> (impl IntoColumnRef, Order);
     fn get_id(&self) -> String;
     fn insert_values(
         self,

src-tauri/yaak-models/src/queries/workspace_metas.rs

@@ -26,7 +26,6 @@ impl<'a> DbContext<'a> {
     pub fn get_or_create_workspace_meta(
         &self,
         workspace_id: &str,
-        source: &UpdateSource,
     ) -> Result<WorkspaceMeta> {
         let workspace_meta = self.get_workspace_meta(workspace_id);
         if let Some(workspace_meta) = workspace_meta {
@@ -38,7 +37,7 @@ impl<'a> DbContext<'a> {
             ..Default::default()
         };
 
-        self.upsert_workspace_meta(&workspace_meta, source)
+        self.upsert_workspace_meta(&workspace_meta, &UpdateSource::Background)
     }
 
     pub fn upsert_workspace_meta(

src-tauri/yaak-models/src/query_manager.rs

@@ -1,15 +1,17 @@
 use crate::connection_or_tx::ConnectionOrTx;
 use crate::db_context::DbContext;
+use crate::error::Error::GenericError;
 use crate::error::Result;
 use crate::util::ModelPayload;
 use r2d2::Pool;
 use r2d2_sqlite::SqliteConnectionManager;
 use rusqlite::TransactionBehavior;
 use std::sync::{Arc, Mutex};
-use tauri::{Manager, Runtime};
+use tauri::{Manager, Runtime, State};
 use tokio::sync::mpsc;
 
 pub trait QueryManagerExt<'a, R> {
+    fn db_manager(&'a self) -> State<'a, QueryManager>;
     fn db(&'a self) -> DbContext<'a>;
     fn with_db<F, T>(&'a self, func: F) -> T
     where
@@ -20,6 +22,10 @@ pub trait QueryManagerExt<'a, R> {
 }
 
 impl<'a, R: Runtime, M: Manager<R>> QueryManagerExt<'a, R> for M {
+    fn db_manager(&'a self) -> State<'a, QueryManager> {
+        self.state::<QueryManager>()
+    }
+
     fn db(&'a self) -> DbContext<'a> {
         let qm = self.state::<QueryManager>();
         qm.inner().connect()
@@ -42,7 +48,7 @@ impl<'a, R: Runtime, M: Manager<R>> QueryManagerExt<'a, R> for M {
     }
 }
 
-#[derive(Clone)]
+#[derive(Debug, Clone)]
 pub struct QueryManager {
     pool: Arc<Mutex<Pool<SqliteConnectionManager>>>,
     events_tx: mpsc::Sender<ModelPayload>,
@@ -91,9 +97,12 @@ impl QueryManager {
         func(&db_context)
     }
 
-    pub fn with_tx<F, T>(&self, func: F) -> Result<T>
+    pub fn with_tx<T, E>(
+        &self,
+        func: impl FnOnce(&DbContext) -> std::result::Result<T, E>,
+    ) -> std::result::Result<T, E>
     where
-        F: FnOnce(&DbContext) -> Result<T>,
+        E: From<crate::error::Error>,
     {
         let mut conn = self
             .pool
@@ -112,11 +121,13 @@ impl QueryManager {
 
         match func(&db_context) {
             Ok(val) => {
-                tx.commit()?;
+                tx.commit()
+                    .map_err(|e| GenericError(format!("Failed to commit transaction {e:?}")))?;
                 Ok(val)
             }
             Err(e) => {
-                tx.rollback()?;
+                tx.rollback()
+                    .map_err(|e| GenericError(format!("Failed to rollback transaction {e:?}")))?;
                 Err(e)
             }
         }

src-tauri/yaak-models/src/util.rs

@@ -1,4 +1,3 @@
-use std::collections::BTreeMap;
 use crate::error::Result;
 use crate::models::{AnyModel, Environment, Folder, GrpcRequest, HttpRequest, UpsertModelInfo, WebsocketRequest, Workspace, WorkspaceIden};
 use crate::query_manager::QueryManagerExt;
@@ -6,6 +5,7 @@ use chrono::{NaiveDateTime, Utc};
 use log::warn;
 use nanoid::nanoid;
 use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
 use tauri::{AppHandle, Listener, Runtime, WebviewWindow};
 use ts_rs::TS;
 
@@ -14,6 +14,10 @@ pub fn generate_prefixed_id(prefix: &str) -> String {
 }
 
 pub fn generate_id() -> String {
+    generate_id_of_length(10)
+}
+
+pub fn generate_id_of_length(n: usize) -> String {
     let alphabet: [char; 57] = [
         '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j',
         'k', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', 'A', 'B', 'C',
@@ -21,7 +25,7 @@ pub fn generate_id() -> String {
         'X', 'Y', 'Z',
     ];
 
-    nanoid!(10, &alphabet)
+    nanoid!(n, &alphabet)
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, TS)]
@@ -101,8 +105,9 @@ pub struct WorkspaceExport {
     pub resources: BatchUpsertResult,
 }
 
-#[derive(Default, Debug, Deserialize, Serialize)]
+#[derive(Default, Debug, Deserialize, Serialize, TS)]
 #[serde(default, rename_all = "camelCase")]
+#[ts(export, export_to = "gen_util.ts")]
 pub struct BatchUpsertResult {
     pub workspaces: Vec<Workspace>,
     pub environments: Vec<Environment>,

src-tauri/yaak-plugins/Cargo.toml

@@ -12,13 +12,16 @@ md5 = "0.7.0"
 path-slash = "0.2.1"
 rand = "0.9.0"
 regex = "1.10.6"
-serde = { version = "1.0.198", features = ["derive"] }
-serde_json = "1.0.113"
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
 tauri = { workspace = true }
 tauri-plugin-shell = { workspace = true }
 thiserror = "2.0.7"
-tokio = { version = "1.42.0", features = ["macros", "rt-multi-thread", "process"] }
+tokio = { workspace = true, features = ["macros", "rt-multi-thread", "process"] }
 tokio-tungstenite = "0.26.1"
 ts-rs = { workspace = true, features = ["import-esm"] }
 yaak-models = { workspace = true }
 yaak-templates = { workspace = true }
+yaak-crypto = { workspace = true }
+yaak-common = { workspace = true }
+base64 = "0.22.1"

src-tauri/yaak-plugins/bindings/gen_events.ts

@@ -344,7 +344,7 @@ export type ImportResources = { workspaces: Array<Workspace>, environments: Arra
 
 export type ImportResponse = { resources: ImportResources, };
 
-export type InternalEvent = { id: string, pluginRefId: string, pluginName: string, replyId: string | null, windowContext: WindowContext, payload: InternalEventPayload, };
+export type InternalEvent = { id: string, pluginRefId: string, pluginName: string, replyId: string | null, windowContext: PluginWindowContext, payload: InternalEventPayload, };
 
 export type InternalEventPayload = { "type": "boot_request" } & BootRequest | { "type": "boot_response" } & BootResponse | { "type": "reload_request" } & EmptyPayload | { "type": "reload_response" } & EmptyPayload | { "type": "terminate_request" } | { "type": "terminate_response" } | { "type": "import_request" } & ImportRequest | { "type": "import_response" } & ImportResponse | { "type": "filter_request" } & FilterRequest | { "type": "filter_response" } & FilterResponse | { "type": "export_http_request_request" } & ExportHttpRequestRequest | { "type": "export_http_request_response" } & ExportHttpRequestResponse | { "type": "send_http_request_request" } & SendHttpRequestRequest | { "type": "send_http_request_response" } & SendHttpRequestResponse | { "type": "get_http_request_actions_request" } & EmptyPayload | { "type": "get_http_request_actions_response" } & GetHttpRequestActionsResponse | { "type": "call_http_request_action_request" } & CallHttpRequestActionRequest | { "type": "get_template_functions_request" } | { "type": "get_template_functions_response" } & GetTemplateFunctionsResponse | { "type": "call_template_function_request" } & CallTemplateFunctionRequest | { "type": "call_template_function_response" } & CallTemplateFunctionResponse | { "type": "get_http_authentication_summary_request" } & EmptyPayload | { "type": "get_http_authentication_summary_response" } & GetHttpAuthenticationSummaryResponse | { "type": "get_http_authentication_config_request" } & GetHttpAuthenticationConfigRequest | { "type": "get_http_authentication_config_response" } & GetHttpAuthenticationConfigResponse | { "type": "call_http_authentication_request" } & CallHttpAuthenticationRequest | { "type": "call_http_authentication_response" } & CallHttpAuthenticationResponse | { "type": "call_http_authentication_action_request" } & CallHttpAuthenticationActionRequest | { "type": "call_http_authentication_action_response" } & EmptyPayload | { "type": "copy_text_request" } & CopyTextRequest | { "type": "copy_text_response" } & EmptyPayload | { "type": "render_http_request_request" } & RenderHttpRequestRequest | { "type": "render_http_request_response" } & RenderHttpRequestResponse | { "type": "get_key_value_request" } & GetKeyValueRequest | { "type": "get_key_value_response" } & GetKeyValueResponse | { "type": "set_key_value_request" } & SetKeyValueRequest | { "type": "set_key_value_response" } & SetKeyValueResponse | { "type": "delete_key_value_request" } & DeleteKeyValueRequest | { "type": "delete_key_value_response" } & DeleteKeyValueResponse | { "type": "open_window_request" } & OpenWindowRequest | { "type": "window_navigate_event" } & WindowNavigateEvent | { "type": "window_close_event" } | { "type": "close_window_request" } & CloseWindowRequest | { "type": "template_render_request" } & TemplateRenderRequest | { "type": "template_render_response" } & TemplateRenderResponse | { "type": "show_toast_request" } & ShowToastRequest | { "type": "show_toast_response" } & EmptyPayload | { "type": "prompt_text_request" } & PromptTextRequest | { "type": "prompt_text_response" } & PromptTextResponse | { "type": "get_http_request_by_id_request" } & GetHttpRequestByIdRequest | { "type": "get_http_request_by_id_response" } & GetHttpRequestByIdResponse | { "type": "find_http_responses_request" } & FindHttpResponsesRequest | { "type": "find_http_responses_response" } & FindHttpResponsesResponse | { "type": "empty_response" } & EmptyPayload | { "type": "error_response" } & ErrorResponse;
 
@@ -356,6 +356,8 @@ export type OpenWindowRequest = { url: string,
  */
 label: string, title?: string, size?: WindowSize, dataDirKey?: string, };
 
+export type PluginWindowContext = { "type": "none" } | { "type": "label", label: string, workspace_id: string | null, };
+
 export type PromptTextRequest = { id: string, title: string, label: string, description?: string, defaultValue?: string, placeholder?: string, 
 /**
  * Text to add to the confirmation button
@@ -393,14 +395,17 @@ export type TemplateFunction = { name: string, description?: string,
  * Also support alternative names. This is useful for not breaking existing
  * tags when changing the `name` property
  */
-aliases?: Array<string>, args: Array<FormInput>, };
+aliases?: Array<string>, args: Array<TemplateFunctionArg>, };
+
+/**
+ * Similar to FormInput, but contains
+ */
+export type TemplateFunctionArg = FormInput;
 
 export type TemplateRenderRequest = { data: JsonValue, purpose: RenderPurpose, };
 
 export type TemplateRenderResponse = { data: JsonValue, };
 
-export type WindowContext = { "type": "none" } | { "type": "label", label: string, };
-
 export type WindowNavigateEvent = { url: string, };
 
 export type WindowSize = { width: number, height: number, };

src-tauri/yaak-plugins/bindings/gen_models.ts

@@ -24,4 +24,4 @@ export type HttpUrlParameter = { enabled?: boolean, name: string, value: string,
 
 export type WebsocketRequest = { model: "websocket_request", id: string, createdAt: string, updatedAt: string, workspaceId: string, folderId: string | null, authentication: Record<string, any>, authenticationType: string | null, description: string, headers: Array<HttpRequestHeader>, message: string, name: string, sortPriority: number, url: string, urlParameters: Array<HttpUrlParameter>, };
 
-export type Workspace = { model: "workspace", id: string, createdAt: string, updatedAt: string, name: string, description: string, settingValidateCertificates: boolean, settingFollowRedirects: boolean, settingRequestTimeout: number, };
+export type Workspace = { model: "workspace", id: string, createdAt: string, updatedAt: string, name: string, description: string, encryptionKeyChallenge: string | null, settingValidateCertificates: boolean, settingFollowRedirects: boolean, settingRequestTimeout: number, };

src-tauri/yaak-plugins/bindings/serde_json/JsonValue.ts

@@ -1,3 +1,3 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 
-export type JsonValue = number | string | Array<JsonValue> | { [key in string]?: JsonValue };
+export type JsonValue = number | string | boolean | Array<JsonValue> | { [key in string]?: JsonValue } | null;

src-tauri/yaak-plugins/src/error.rs

@@ -5,6 +5,12 @@ use tokio::sync::mpsc::error::SendError;
 
 #[derive(Error, Debug)]
 pub enum Error {
+    #[error(transparent)]
+    CryptoErr(#[from] yaak_crypto::error::Error),
+
+    #[error(transparent)]
+    TemplateErr(#[from] yaak_templates::error::Error),
+    
     #[error("IO error: {0}")]
     IoErr(#[from] io::Error),
 

src-tauri/yaak-plugins/src/events.rs

@@ -2,7 +2,7 @@ use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use tauri::{Runtime, WebviewWindow};
 use ts_rs::TS;
-
+use yaak_common::window::WorkspaceWindowTrait;
 use yaak_models::models::{
     Environment, Folder, GrpcRequest, HttpRequest, HttpResponse, WebsocketRequest, Workspace,
 };
@@ -15,7 +15,7 @@ pub struct InternalEvent {
     pub plugin_ref_id: String,
     pub plugin_name: String,
     pub reply_id: Option<String>,
-    pub window_context: WindowContext,
+    pub window_context: PluginWindowContext,
     pub payload: InternalEventPayload,
 }
 
@@ -29,22 +29,32 @@ pub(crate) struct InternalEventRawPayload {
     pub plugin_ref_id: String,
     pub plugin_name: String,
     pub reply_id: Option<String>,
-    pub window_context: WindowContext,
+    pub window_context: PluginWindowContext,
     pub payload: serde_json::Value,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, TS)]
 #[serde(rename_all = "snake_case", tag = "type")]
 #[ts(export, export_to = "gen_events.ts")]
-pub enum WindowContext {
+pub enum PluginWindowContext {
     None,
-    Label { label: String },
+    Label {
+        label: String,
+        workspace_id: Option<String>,
+    },
 }
 
-impl WindowContext {
-    pub fn from_window<R: Runtime>(window: &WebviewWindow<R>) -> Self {
+impl PluginWindowContext {
+    pub fn new<R: Runtime>(window: &WebviewWindow<R>) -> Self {
         Self::Label {
             label: window.label().to_string(),
+            workspace_id: window.workspace_id(),
+        }
+    }
+    pub fn new_no_workspace<R: Runtime>(window: &WebviewWindow<R>) -> Self {
+        Self::Label {
+            label: window.label().to_string(),
+            workspace_id: None,
         }
     }
 }
@@ -497,7 +507,15 @@ pub struct TemplateFunction {
     /// tags when changing the `name` property
     #[ts(optional)]
     pub aliases: Option<Vec<String>>,
-    pub args: Vec<FormInput>,
+    pub args: Vec<TemplateFunctionArg>,
+}
+
+/// Similar to FormInput, but contains
+#[derive(Debug, Clone, Serialize, Deserialize, TS)]
+#[serde(rename_all = "snake_case", untagged)]
+#[ts(export, export_to = "gen_events.ts")]
+pub enum TemplateFunctionArg {
+    FormInput(FormInput),
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, TS)]

src-tauri/yaak-plugins/src/lib.rs

@@ -7,10 +7,11 @@ use tauri::{Manager, RunEvent, Runtime, State};
 pub mod error;
 pub mod events;
 pub mod manager;
-pub mod plugin_handle;
-pub mod template_callback;
+pub mod native_template_functions;
 mod nodejs;
+pub mod plugin_handle;
 mod server_ws;
+pub mod template_callback;
 mod util;
 
 pub fn init<R: Runtime>() -> TauriPlugin<R> {
@@ -18,7 +19,6 @@ pub fn init<R: Runtime>() -> TauriPlugin<R> {
         .setup(|app_handle, _| {
             let manager = PluginManager::new(app_handle.clone());
             app_handle.manage(manager.clone());
-
             Ok(())
         })
         .on_event(|app, e| match e {

src-tauri/yaak-plugins/src/manager.rs

@@ -9,7 +9,7 @@ use crate::events::{
     EmptyPayload, FilterRequest, FilterResponse, GetHttpAuthenticationConfigRequest,
     GetHttpAuthenticationConfigResponse, GetHttpAuthenticationSummaryResponse,
     GetHttpRequestActionsResponse, GetTemplateFunctionsResponse, ImportRequest, ImportResponse,
-    InternalEvent, InternalEventPayload, JsonPrimitive, RenderPurpose, WindowContext,
+    InternalEvent, InternalEventPayload, JsonPrimitive, PluginWindowContext, RenderPurpose,
 };
 use crate::nodejs::start_nodejs_plugin_runtime;
 use crate::plugin_handle::PluginHandle;
@@ -30,6 +30,7 @@ use yaak_models::query_manager::QueryManagerExt;
 use yaak_models::util::generate_id;
 use yaak_templates::error::Error::RenderError;
 use yaak_templates::error::Result as TemplateResult;
+use crate::native_template_functions::template_function_secure;
 
 #[derive(Clone)]
 pub struct PluginManager {
@@ -100,7 +101,7 @@ impl PluginManager {
                     Ok(_) => {
                         info!("Plugin runtime client connected!");
                         plugin_manager
-                            .initialize_all_plugins(&app_handle, &WindowContext::None)
+                            .initialize_all_plugins(&app_handle, &PluginWindowContext::None)
                             .await
                             .expect("Failed to reload plugins");
                     }
@@ -172,14 +173,14 @@ impl PluginManager {
         [bundled_plugin_dirs, installed_plugin_dirs].concat()
     }
 
-    pub async fn uninstall(&self, window_context: &WindowContext, dir: &str) -> Result<()> {
+    pub async fn uninstall(&self, window_context: &PluginWindowContext, dir: &str) -> Result<()> {
         let plugin = self.get_plugin_by_dir(dir).await.ok_or(PluginNotFoundErr(dir.to_string()))?;
         self.remove_plugin(window_context, &plugin).await
     }
 
     async fn remove_plugin(
         &self,
-        window_context: &WindowContext,
+        window_context: &PluginWindowContext,
         plugin: &PluginHandle,
     ) -> Result<()> {
         // Terminate the plugin
@@ -197,7 +198,7 @@ impl PluginManager {
 
     pub async fn add_plugin_by_dir(
         &self,
-        window_context: &WindowContext,
+        window_context: &PluginWindowContext,
         dir: &str,
         watch: bool,
     ) -> Result<()> {
@@ -240,7 +241,7 @@ impl PluginManager {
     pub async fn initialize_all_plugins<R: Runtime>(
         &self,
         app_handle: &AppHandle<R>,
-        window_context: &WindowContext,
+        window_context: &PluginWindowContext,
     ) -> Result<()> {
         let start = Instant::now();
         let candidates = self.list_plugin_dirs(app_handle).await;
@@ -325,7 +326,7 @@ impl PluginManager {
 
     async fn send_to_plugin_and_wait(
         &self,
-        window_context: &WindowContext,
+        window_context: &PluginWindowContext,
         plugin: &PluginHandle,
         payload: &InternalEventPayload,
     ) -> Result<InternalEvent> {
@@ -336,7 +337,7 @@ impl PluginManager {
 
     async fn send_and_wait(
         &self,
-        window_context: &WindowContext,
+        window_context: &PluginWindowContext,
         payload: &InternalEventPayload,
     ) -> Result<Vec<InternalEvent>> {
         let plugins = { self.plugins.lock().await.clone() };
@@ -345,7 +346,7 @@ impl PluginManager {
 
     async fn send_to_plugins_and_wait(
         &self,
-        window_context: &WindowContext,
+        window_context: &PluginWindowContext,
         payload: &InternalEventPayload,
         plugins: Vec<PluginHandle>,
     ) -> Result<Vec<InternalEvent>> {
@@ -408,7 +409,7 @@ impl PluginManager {
     ) -> Result<Vec<GetHttpRequestActionsResponse>> {
         let reply_events = self
             .send_and_wait(
-                &WindowContext::from_window(window),
+                &PluginWindowContext::new(window),
                 &InternalEventPayload::GetHttpRequestActionsRequest(EmptyPayload {}),
             )
             .await?;
@@ -427,25 +428,31 @@ impl PluginManager {
         &self,
         window: &WebviewWindow<R>,
     ) -> Result<Vec<GetTemplateFunctionsResponse>> {
-        self.get_template_functions_with_context(&WindowContext::from_window(window)).await
+        self.get_template_functions_with_context(&PluginWindowContext::new(&window)).await
     }
 
     pub async fn get_template_functions_with_context(
         &self,
-        window_context: &WindowContext,
+        window_context: &PluginWindowContext,
     ) -> Result<Vec<GetTemplateFunctionsResponse>> {
         let reply_events = self
             .send_and_wait(window_context, &InternalEventPayload::GetTemplateFunctionsRequest)
             .await?;
 
-        let mut all_actions = Vec::new();
+        let mut result = Vec::new();
         for event in reply_events {
             if let InternalEventPayload::GetTemplateFunctionsResponse(resp) = event.payload {
-                all_actions.push(resp.clone());
+                result.push(resp.clone());
             }
         }
 
-        Ok(all_actions)
+        // Add Rust-based functions
+        result.push(GetTemplateFunctionsResponse {
+            plugin_ref_id: "__NATIVE__".to_string(), // Meh
+            functions: vec![template_function_secure()],
+        });
+
+        Ok(result)
     }
 
     pub async fn call_http_request_action<R: Runtime>(
@@ -457,7 +464,7 @@ impl PluginManager {
         let plugin =
             self.get_plugin_by_ref_id(ref_id.as_str()).await.ok_or(PluginNotFoundErr(ref_id))?;
         let event = plugin.build_event_to_send(
-            &WindowContext::from_window(window),
+            &PluginWindowContext::new(window),
             &InternalEventPayload::CallHttpRequestActionRequest(req),
             None,
         );
@@ -469,7 +476,7 @@ impl PluginManager {
         &self,
         window: &WebviewWindow<R>,
     ) -> Result<Vec<(PluginHandle, GetHttpAuthenticationSummaryResponse)>> {
-        let window_context = WindowContext::from_window(window);
+        let window_context = PluginWindowContext::new(window);
         let reply_events = self
             .send_and_wait(
                 &window_context,
@@ -508,7 +515,7 @@ impl PluginManager {
         let context_id = format!("{:x}", md5::compute(request_id.to_string()));
         let event = self
             .send_to_plugin_and_wait(
-                &WindowContext::from_window(window),
+                &PluginWindowContext::new(window),
                 &plugin,
                 &InternalEventPayload::GetHttpAuthenticationConfigRequest(
                     GetHttpAuthenticationConfigRequest { values, context_id },
@@ -540,7 +547,7 @@ impl PluginManager {
 
         let context_id = format!("{:x}", md5::compute(request_id.to_string()));
         self.send_to_plugin_and_wait(
-            &WindowContext::from_window(window),
+            &PluginWindowContext::new(window),
             &plugin,
             &InternalEventPayload::CallHttpAuthenticationActionRequest(
                 CallHttpAuthenticationActionRequest {
@@ -581,7 +588,7 @@ impl PluginManager {
 
         let event = self
             .send_to_plugin_and_wait(
-                &WindowContext::from_window(window),
+                &PluginWindowContext::new(window),
                 &plugin,
                 &InternalEventPayload::CallHttpAuthenticationRequest(req),
             )
@@ -597,7 +604,7 @@ impl PluginManager {
 
     pub async fn call_template_function(
         &self,
-        window_context: &WindowContext,
+        window_context: &PluginWindowContext,
         fn_name: &str,
         args: HashMap<String, String>,
         purpose: RenderPurpose,
@@ -636,7 +643,7 @@ impl PluginManager {
     ) -> Result<ImportResponse> {
         let reply_events = self
             .send_and_wait(
-                &WindowContext::from_window(window),
+                &PluginWindowContext::new(window),
                 &InternalEventPayload::ImportRequest(ImportRequest {
                     content: content.to_string(),
                 }),
@@ -675,7 +682,7 @@ impl PluginManager {
 
         let event = self
             .send_to_plugin_and_wait(
-                &WindowContext::from_window(window),
+                &PluginWindowContext::new(window),
                 &plugin,
                 &InternalEventPayload::FilterRequest(FilterRequest {
                     filter: filter.to_string(),

src-tauri/yaak-plugins/src/native_template_functions.rs

@@ -0,0 +1,164 @@
+use crate::events::{
+    FormInput, FormInputBase, FormInputText, PluginWindowContext, RenderPurpose, TemplateFunction,
+    TemplateFunctionArg,
+};
+use crate::template_callback::PluginTemplateCallback;
+use base64::Engine;
+use base64::prelude::BASE64_STANDARD;
+use std::collections::HashMap;
+use tauri::{AppHandle, Runtime};
+use yaak_crypto::manager::EncryptionManagerExt;
+use yaak_templates::error::Error::RenderError;
+use yaak_templates::error::Result;
+use yaak_templates::{FnArg, Parser, Token, Tokens, Val, transform_args};
+
+pub(crate) fn template_function_secure() -> TemplateFunction {
+    TemplateFunction {
+        name: "secure".to_string(),
+        description: Some("Securely store encrypted text".to_string()),
+        aliases: None,
+        args: vec![TemplateFunctionArg::FormInput(FormInput::Text(
+            FormInputText {
+                multi_line: Some(true),
+                password: Some(true),
+                base: FormInputBase {
+                    name: "value".to_string(),
+                    label: Some("Value".to_string()),
+                    ..Default::default()
+                },
+                ..Default::default()
+            },
+        ))],
+    }
+}
+
+pub fn template_function_secure_run<R: Runtime>(
+    app_handle: &AppHandle<R>,
+    args: HashMap<String, String>,
+    window_context: &PluginWindowContext,
+) -> Result<String> {
+    match window_context.clone() {
+        PluginWindowContext::Label {
+            workspace_id: Some(wid),
+            ..
+        } => {
+            let value = args.get("value").map(|v| v.to_owned()).unwrap_or_default();
+            if value.is_empty() {
+                return Ok("".to_string());
+            }
+
+            let value = match value.strip_prefix("YENC_") {
+                None => {
+                    return Err(RenderError("Could not decrypt non-encrypted value".to_string()));
+                }
+                Some(v) => v,
+            };
+
+            let value = BASE64_STANDARD.decode(&value).unwrap();
+            let r = match app_handle.crypto().decrypt(&wid, value.as_slice()) {
+                Ok(r) => Ok(r),
+                Err(e) => Err(RenderError(e.to_string())),
+            }?;
+            let r = String::from_utf8(r).map_err(|e| RenderError(e.to_string()))?;
+            Ok(r)
+        }
+        _ => Err(RenderError("workspace_id missing from window context".to_string())),
+    }
+}
+
+pub fn template_function_secure_transform_arg<R: Runtime>(
+    app_handle: &AppHandle<R>,
+    window_context: &PluginWindowContext,
+    arg_name: &str,
+    arg_value: &str,
+) -> Result<String> {
+    if arg_name != "value" {
+        return Ok(arg_value.to_string());
+    }
+
+    match window_context.clone() {
+        PluginWindowContext::Label {
+            workspace_id: Some(wid),
+            ..
+        } => {
+            if arg_value.is_empty() {
+                return Ok("".to_string());
+            }
+
+            if arg_value.starts_with("YENC_") {
+                // Already encrypted, so do nothing
+                return Ok(arg_value.to_string());
+            }
+
+            let r = app_handle
+                .crypto()
+                .encrypt(&wid, arg_value.as_bytes())
+                .map_err(|e| RenderError(e.to_string()))?;
+            let r = BASE64_STANDARD.encode(r);
+            Ok(format!("YENC_{}", r))
+        }
+        _ => Err(RenderError("workspace_id missing from window context".to_string())),
+    }
+}
+
+pub fn decrypt_secure_template_function<R: Runtime>(
+    app_handle: &AppHandle<R>,
+    window_context: &PluginWindowContext,
+    template: &str,
+) -> Result<String> {
+    let mut parsed = Parser::new(template).parse()?;
+    let mut new_tokens: Vec<Token> = Vec::new();
+
+    for token in parsed.tokens.iter() {
+        match token {
+            Token::Tag {
+                val: Val::Fn { name, args },
+            } if name == "secure" => {
+                let mut args_map = HashMap::new();
+                for a in args {
+                    match a.clone().value {
+                        Val::Str { text } => {
+                            args_map.insert(a.name.to_string(), text);
+                        }
+                        _ => continue,
+                    }
+                }
+                new_tokens.push(Token::Raw {
+                    text: template_function_secure_run(app_handle, args_map, window_context)?,
+                });
+            }
+            t => {
+                new_tokens.push(t.clone());
+                continue;
+            }
+        };
+    }
+
+    parsed.tokens = new_tokens;
+    Ok(parsed.to_string())
+}
+
+pub fn encrypt_secure_template_function<R: Runtime>(
+    app_handle: &AppHandle<R>,
+    window_context: &PluginWindowContext,
+    template: &str,
+) -> Result<String> {
+    let decrypted = decrypt_secure_template_function(&app_handle, window_context, template)?;
+    let tokens = Tokens {
+        tokens: vec![Token::Tag {
+            val: Val::Fn {
+                name: "secure".to_string(),
+                args: vec![FnArg {
+                    name: "value".to_string(),
+                    value: Val::Str { text: decrypted },
+                }],
+            },
+        }],
+    };
+
+    Ok(transform_args(
+        tokens,
+        &PluginTemplateCallback::new(app_handle, window_context, RenderPurpose::Preview),
+    )?
+    .to_string())
+}

src-tauri/yaak-plugins/src/plugin_handle.rs

@@ -1,5 +1,5 @@
 use crate::error::Result;
-use crate::events::{BootResponse, InternalEvent, InternalEventPayload, WindowContext};
+use crate::events::{BootResponse, InternalEvent, InternalEventPayload, PluginWindowContext};
 use crate::util::gen_id;
 use log::info;
 use std::path::Path;
@@ -37,7 +37,7 @@ impl PluginHandle {
 
     pub fn build_event_to_send(
         &self,
-        window_context: &WindowContext,
+        window_context: &PluginWindowContext,
         payload: &InternalEventPayload,
         reply_id: Option<String>,
     ) -> InternalEvent {
@@ -46,7 +46,7 @@ impl PluginHandle {
 
     pub(crate) fn build_event_to_send_raw(
         &self,
-        window_context: &WindowContext,
+        window_context: &PluginWindowContext,
         payload: &InternalEventPayload,
         reply_id: Option<String>,
     ) -> InternalEvent {
@@ -61,7 +61,7 @@ impl PluginHandle {
         }
     }
 
-    pub async fn terminate(&self, window_context: &WindowContext) -> Result<()> {
+    pub async fn terminate(&self, window_context: &PluginWindowContext) -> Result<()> {
         info!("Terminating plugin {}", self.dir);
         let event =
             self.build_event_to_send(window_context, &InternalEventPayload::TerminateRequest, None);

src-tauri/yaak-plugins/src/template_callback.rs

@@ -1,40 +1,46 @@
-use crate::events::{RenderPurpose, WindowContext};
+use crate::events::{PluginWindowContext, RenderPurpose};
 use crate::manager::PluginManager;
+use crate::native_template_functions::{
+    template_function_secure_run, template_function_secure_transform_arg,
+};
 use std::collections::HashMap;
 use tauri::{AppHandle, Manager, Runtime};
 use yaak_templates::error::Result;
 use yaak_templates::TemplateCallback;
 
 #[derive(Clone)]
-pub struct PluginTemplateCallback {
-    plugin_manager: PluginManager,
-    window_context: WindowContext,
+pub struct PluginTemplateCallback<R: Runtime> {
+    app_handle: AppHandle<R>,
     render_purpose: RenderPurpose,
+    window_context: PluginWindowContext,
 }
 
-impl PluginTemplateCallback {
-    pub fn new<R: Runtime>(
+impl<R: Runtime> PluginTemplateCallback<R> {
+    pub fn new(
         app_handle: &AppHandle<R>,
-        window_context: &WindowContext,
+        window_context: &PluginWindowContext,
         render_purpose: RenderPurpose,
-    ) -> PluginTemplateCallback {
-        let plugin_manager = &*app_handle.state::<PluginManager>();
+    ) -> PluginTemplateCallback<R> {
         PluginTemplateCallback {
-            plugin_manager: plugin_manager.to_owned(),
-            window_context: window_context.to_owned(),
             render_purpose,
+            app_handle: app_handle.to_owned(),
+            window_context: window_context.to_owned(),
         }
     }
 }
 
-impl TemplateCallback for PluginTemplateCallback {
+impl<R: Runtime> TemplateCallback for PluginTemplateCallback<R> {
     async fn run(&self, fn_name: &str, args: HashMap<String, String>) -> Result<String> {
         // The beta named the function `Response` but was changed in stable.
         // Keep this here for a while because there's no easy way to migrate
         let fn_name = if fn_name == "Response" { "response" } else { fn_name };
 
-        let resp = self
-            .plugin_manager
+        if fn_name == "secure" {
+            return template_function_secure_run(&self.app_handle, args, &self.window_context);
+        }
+
+        let plugin_manager = &*self.app_handle.state::<PluginManager>();
+        let resp = plugin_manager
             .call_template_function(
                 &self.window_context,
                 fn_name,
@@ -44,4 +50,22 @@ impl TemplateCallback for PluginTemplateCallback {
             .await?;
         Ok(resp)
     }
+
+    fn transform_arg(
+        &self,
+        fn_name: &str,
+        arg_name: &str,
+        arg_value: &str,
+    ) -> Result<String> {
+        if fn_name == "secure" {
+            return template_function_secure_transform_arg(
+                &self.app_handle,
+                &self.window_context,
+                arg_name,
+                arg_value,
+            );
+        }
+
+        Ok(arg_value.to_string())
+    }
 }

src-tauri/yaak-sse/Cargo.toml

@@ -5,5 +5,5 @@ edition = "2024"
 publish = false
 
 [dependencies]
-serde = { version = "1.0.204", features = ["derive"] }
-ts-rs = { version = "10.0.0", features = ["serde-json-impl"] }
+serde = { workspace = true, features = ["derive"] }
+ts-rs = { workspace = true, features = ["serde-json-impl"] }

src-tauri/yaak-sync/Cargo.toml

@@ -6,19 +6,19 @@ edition = "2024"
 publish = false
 
 [dependencies]
-yaak-models = { workspace = true }
 chrono = { version = "0.4.38", features = ["serde"] }
-serde = { version = "1.0.215", features = ["derive"] }
+hex = "0.4.3"
+log = "0.4.22"
+notify = "8.0.0"
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+serde_yaml = "0.9.34"
+sha1 = "0.10.6"
 tauri = { workspace = true }
 thiserror = { workspace = true }
+tokio = { workspace = true, features = ["fs", "sync", "macros"] }
 ts-rs = { workspace = true, features = ["chrono-impl", "serde-json-impl"] }
-serde_yaml = "0.9.34"
-log = "0.4.22"
-serde_json = "1.0.132"
-hex = "0.4.3"
-sha1 = "0.10.6"
-tokio = { version = "1.42.0", features = ["fs", "sync", "macros"] }
-notify = "7.0.0"
+yaak-models = { workspace = true }
 
 [build-dependencies]
 tauri-plugin = { workspace = true, features = ["build"] }