refactor: Fix macOS standalone application

Library/Network/XPCConnectionValidator.swift

@@ -0,0 +1,80 @@
+#if os(macOS)
+    import Foundation
+    import Security
+
+    public struct XPCConnectionInfo {
+        public let pid: pid_t
+        public let bundleID: String?
+        public let teamID: String?
+    }
+
+    public enum XPCConnectionValidator {
+        private static func getSecCode(for connection: NSXPCConnection) -> SecCode? {
+            let pid = connection.processIdentifier
+            var code: SecCode?
+            let attributes = [kSecGuestAttributePid: pid] as CFDictionary
+            guard SecCodeCopyGuestWithAttributes(nil, attributes, [], &code) == errSecSuccess else {
+                return nil
+            }
+            return code
+        }
+
+        private static func getSigningInfo(_ code: SecCode) -> [String: Any]? {
+            var staticCode: SecStaticCode?
+            guard SecCodeCopyStaticCode(code, [], &staticCode) == errSecSuccess,
+                  let staticCode
+            else {
+                return nil
+            }
+
+            var info: CFDictionary?
+            guard SecCodeCopySigningInformation(staticCode, [], &info) == errSecSuccess else {
+                return nil
+            }
+            return info as? [String: Any]
+        }
+
+        public static func getConnectionInfo(_ connection: NSXPCConnection) -> XPCConnectionInfo {
+            let pid = connection.processIdentifier
+
+            guard let secCode = getSecCode(for: connection),
+                  let signingInfo = getSigningInfo(secCode)
+            else {
+                return XPCConnectionInfo(pid: pid, bundleID: nil, teamID: nil)
+            }
+
+            let bundleID = signingInfo[kSecCodeInfoIdentifier as String] as? String
+            let teamID = signingInfo[kSecCodeInfoTeamIdentifier as String] as? String
+
+            return XPCConnectionInfo(pid: pid, bundleID: bundleID, teamID: teamID)
+        }
+
+        public static func validateConnection(
+            _ connection: NSXPCConnection,
+            teamID: String,
+            allowedBundleIDs: [String]
+        ) -> Bool {
+            guard let secCode = getSecCode(for: connection) else {
+                return false
+            }
+
+            let requirement = "anchor apple generic and certificate leaf[subject.OU] = \"\(teamID)\""
+            var secRequirement: SecRequirement?
+            guard SecRequirementCreateWithString(requirement as CFString, [], &secRequirement) == errSecSuccess,
+                  let req = secRequirement,
+                  SecCodeCheckValidity(secCode, [], req) == errSecSuccess
+            else {
+                return false
+            }
+
+            guard let signingInfo = getSigningInfo(secCode),
+                  let bundleID = signingInfo[kSecCodeInfoIdentifier as String] as? String,
+                  allowedBundleIDs.contains(bundleID)
+            else {
+                return false
+            }
+
+            return true
+        }
+    }
+#endif