chore: make helper launchdaemon approval mandatory (#205)

First step in addressing #201.

This PR installs and kickstarts the LaunchDaemon as part of the `.pkg` installer, instead of requiring it be approved via the UI. As such, we no longer distribute the app contained within a `.zip`.

This PR adds a build script to install the LaunchDaemon when developing locally, to ensure it stays up to date when changes are made. Installing the LaunchDaemon requires administrator privileges, so to minimise password prompts, we only restart it when the binary itself, or any of it's frameworks have changed.

There's an Apple Developer Forum thread where I replied, enquiring about this installer approach vs the existing SMAppService approach, esp. w.r.t deploying the app via MDM: https://developer.apple.com/forums/thread/766351?answerId=850675022&page=1#851913022


(This PR previously had UI changes, and I did some refactoring. That refactoring is still in the diff.)

Author: ethanndickson

Coder-Desktop/Coder-Desktop/Coder_DesktopApp.swift

@@ -26,7 +26,6 @@ struct DesktopApp: App {
             SettingsView<CoderVPNService>()
                 .environmentObject(appDelegate.vpn)
                 .environmentObject(appDelegate.state)
-                .environmentObject(appDelegate.helper)
                 .environmentObject(appDelegate.autoUpdater)
         }
         .windowResizability(.contentSize)
@@ -48,13 +47,11 @@ class AppDelegate: NSObject, NSApplicationDelegate {
     let fileSyncDaemon: MutagenDaemon
     let urlHandler: URLHandler
     let notifDelegate: NotifDelegate
-    let helper: HelperService
     let autoUpdater: UpdaterService
 
     override init() {
         notifDelegate = NotifDelegate()
         vpn = CoderVPNService()
-        helper = HelperService()
         autoUpdater = UpdaterService()
         let state = AppState(onChange: vpn.configureTunnelProviderProtocol)
         vpn.onStart = {

Coder-Desktop/Coder-Desktop/HelperService.swift

@@ -13,11 +13,6 @@ struct SettingsView<VPN: VPNService>: View {
                 .tabItem {
                     Label("Network", systemImage: "dot.radiowaves.left.and.right")
                 }.tag(SettingsTab.network)
-            ExperimentalTab()
-                .tabItem {
-                    Label("Experimental", systemImage: "gearshape.2")
-                }.tag(SettingsTab.experimental)
-
         }.frame(width: 600)
             .frame(maxHeight: 500)
             .scrollContentBackground(.hidden)
@@ -28,5 +23,4 @@ struct SettingsView<VPN: VPNService>: View {
 enum SettingsTab: Int {
     case general
     case network
-    case experimental
 }

Coder-Desktop/Coder-Desktop/Views/Settings/ExperimentalTab.swift

@@ -10,20 +10,10 @@ struct VPNState<VPN: VPNService>: View {
         Group {
             switch (vpn.state, state.hasSession) {
             case (.failed(.systemExtensionError(.needsUserApproval)), _):
-                VStack {
-                    Text("Awaiting System Extension approval")
-                        .foregroundColor(.secondary)
-                        .multilineTextAlignment(.center)
-                        .fixedSize(horizontal: false, vertical: true)
-                        .padding(.horizontal, Theme.Size.trayInset)
-                        .padding(.vertical, Theme.Size.trayPadding)
-                        .frame(maxWidth: .infinity)
-                    Button {
-                        openSystemExtensionSettings()
-                    } label: {
-                        Text("Approve in System Settings")
-                    }
-                }
+                ApprovalRequiredView(
+                    message: "Awaiting System Extension approval",
+                    action: openSystemExtensionSettings
+                )
             case (_, false):
                 Text("Sign in to use Coder Desktop")
                     .font(.body)
@@ -32,11 +22,7 @@ struct VPNState<VPN: VPNService>: View {
                 VStack {
                     Text("The system VPN requires reconfiguration")
                         .foregroundColor(.secondary)
-                        .multilineTextAlignment(.center)
-                        .fixedSize(horizontal: false, vertical: true)
-                        .padding(.horizontal, Theme.Size.trayInset)
-                        .padding(.vertical, Theme.Size.trayPadding)
-                        .frame(maxWidth: .infinity)
+                        .vpnStateMessage()
                     Button {
                         state.reconfigure()
                     } label: {
@@ -61,15 +47,46 @@ struct VPNState<VPN: VPNService>: View {
                 Text("\(vpnErr.description)")
                     .font(.headline)
                     .foregroundColor(.red)
-                    .multilineTextAlignment(.center)
-                    .fixedSize(horizontal: false, vertical: true)
-                    .padding(.horizontal, Theme.Size.trayInset)
-                    .padding(.vertical, Theme.Size.trayPadding)
-                    .frame(maxWidth: .infinity)
+                    .vpnStateMessage()
             case (.connected, true):
                 EmptyView()
             }
         }
         .onReceive(inspection.notice) { inspection.visit(self, $0) } // viewInspector
     }
 }
+
+struct ApprovalRequiredView: View {
+    let message: String
+    let action: () -> Void
+
+    var body: some View {
+        VStack {
+            Text(message)
+                .foregroundColor(.secondary)
+                .vpnStateMessage()
+            Button {
+                action()
+            } label: {
+                Text("Approve in System Settings")
+            }
+        }
+    }
+}
+
+struct VPNStateMessageTextModifier: ViewModifier {
+    func body(content: Content) -> some View {
+        content
+            .multilineTextAlignment(.center)
+            .fixedSize(horizontal: false, vertical: true)
+            .padding(.horizontal, Theme.Size.trayInset)
+            .padding(.vertical, Theme.Size.trayPadding)
+            .frame(maxWidth: .infinity)
+    }
+}
+
+extension View {
+    func vpnStateMessage() -> some View {
+        modifier(VPNStateMessageTextModifier())
+    }
+}

Coder-Desktop/Coder-Desktop/Views/Settings/HelperSection.swift

@@ -4,8 +4,8 @@
 <dict>
 	<key>Label</key>
 	<string>com.coder.Coder-Desktop.Helper</string>
-	<key>BundleProgram</key>
-	<string>Contents/MacOS/com.coder.Coder-Desktop.Helper</string>
+	<key>Program</key>
+	<string>/Applications/Coder Desktop.app/Contents/MacOS/com.coder.Coder-Desktop.Helper</string>
 	<key>MachServices</key>
 	<dict>
 		<!-- $(TeamIdentifierPrefix) isn't populated here, so this value is hardcoded -->

Coder-Desktop/Coder-Desktop/Views/Settings/Settings.swift

@@ -216,6 +216,29 @@ targets:
     buildToolPlugins:
       - plugin: SwiftLintBuildToolPlugin
         package: SwiftLintPlugins
+    postBuildScripts:
+      # This is a dependency of the app, not the helper, as it copies the
+      # helper plist from the app bundle to the system store.
+      - name: "Upsert Helper for Local Development"
+        # Only run this script (and prompt for admin) when the helper or any of
+        # it's frameworks have changed.
+        inputFiles:
+          - "$(BUILT_PRODUCTS_DIR)/com.coder.Coder-Desktop.Helper"
+          - "$(BUILT_PRODUCTS_DIR)/CoderSDK.framework/Versions/A/CoderSDK"
+          - "$(BUILT_PRODUCTS_DIR)/VPNLib.framework/Versions/A/VPNLib"
+        outputFiles:
+          - "$(DERIVED_FILE_DIR)/upsert-helper.stamp"
+        script: |
+          if [ -n "${CI}" ]; then
+            # Skip in CI
+            exit 0
+          fi
+          /usr/bin/osascript <<'APPLESCRIPT'
+          do shell script "/bin/bash -c " & quoted form of ((system attribute "SRCROOT") & "/../scripts/upsert-dev-helper.sh") with administrator privileges
+          APPLESCRIPT
+          /usr/bin/touch "${DERIVED_FILE_DIR}/upsert-helper.stamp"
+        basedOnDependencyAnalysis: true
+        runOnlyWhenInstalling: false
 
   Coder-DesktopTests:
     type: bundle.unit-test
@@ -376,4 +399,4 @@ targets:
         PRODUCT_BUNDLE_IDENTIFIER: "com.coder.Coder-Desktop.Helper"
         PRODUCT_MODULE_NAME: "$(PRODUCT_NAME:c99extidentifier)"
         PRODUCT_NAME: "$(PRODUCT_BUNDLE_IDENTIFIER)"
-        SKIP_INSTALL: YES
+        SKIP_INSTALL: YES