autostart on MacOS

Author: j-chmielewski

new-ui/package.json

@@ -20,7 +20,6 @@
     "@stablelib/base64": "^2.0.1",
     "@stablelib/x25519": "^2.0.1",
     "@tanstack/react-form": "^1.33.5",
-    "@tauri-apps/plugin-autostart": "^2.7.0",
     "@tanstack/react-query": "^5.104.1",
     "@tanstack/react-router": "^1.170.41",
     "@tauri-apps/api": "^2.12.1",

new-ui/pnpm-lock.yaml

@@ -1,9 +1,9 @@
 import './style.scss';
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
-import { disable, enable, isEnabled } from '@tauri-apps/plugin-autostart';
 import { openUrl } from '@tauri-apps/plugin-opener';
 import clsx from 'clsx';
 import { type ReactNode, useMemo, useState } from 'react';
+import { getAutostartStatus, setAutostartEnabled } from '../../../shared/autostart';
 import { Divider } from '../../../shared/components/Divider/Divider';
 import { FullPageTitle } from '../../../shared/components/FullPageTitle/FullPageTitle';
 import { Icon, IconKind } from '../../../shared/components/Icon';
@@ -38,12 +38,12 @@ export const SettingsPage = () => {
   const queryClient = useQueryClient();
   const { data: appConfig } = useQuery(getAppConfigQueryOptions);
   const {
-    data: autostartEnabled,
+    data: autostartStatus,
     isError: isAutostartStatusError,
     isPending: isAutostartStatusPending,
   } = useQuery({
     queryKey: AUTOSTART_QUERY_KEY,
-    queryFn: isEnabled,
+    queryFn: getAutostartStatus,
   });
 
   const { mutate: patchConfig } = useMutation({
@@ -56,15 +56,13 @@ export const SettingsPage = () => {
     },
   });
 
-  const { mutate: setAutostart, isPending: isAutostartUpdating } = useMutation({
-    mutationFn: async (enabled: boolean) => {
-      if (enabled) {
-        await enable();
-      } else {
-        await disable();
-      }
-    },
-    onSuccess: () => queryClient.invalidateQueries({ queryKey: AUTOSTART_QUERY_KEY }),
+  const {
+    mutate: setAutostart,
+    isPending: isAutostartUpdating,
+    isError: isAutostartUpdateError,
+  } = useMutation({
+    mutationFn: setAutostartEnabled,
+    onSettled: () => queryClient.invalidateQueries({ queryKey: AUTOSTART_QUERY_KEY }),
     onError: (error) => {
       console.error(error);
     },
@@ -172,14 +170,28 @@ export const SettingsPage = () => {
         <div className="sections startup-settings">
           <SettingRow
             title="Start Defguard automatically when your operating system starts"
+            description={
+              autostartStatus === 'requiresApproval'
+                ? 'Approve Defguard in System Settings > General > Login Items to start it at login.'
+                : isAutostartStatusError ||
+                    isAutostartUpdateError ||
+                    autostartStatus === 'notFound'
+                  ? 'Could not update or check login startup. Please try again.'
+                  : undefined
+            }
             inline
           >
             <Toggle
-              active={autostartEnabled ?? false}
+              active={
+                autostartStatus === 'enabled' || autostartStatus === 'requiresApproval'
+              }
               disabled={
-                isAutostartStatusPending || isAutostartStatusError || isAutostartUpdating
+                isAutostartStatusPending ||
+                isAutostartStatusError ||
+                isAutostartUpdating ||
+                autostartStatus === 'notFound'
               }
-              onClick={() => setAutostart(!autostartEnabled)}
+              onClick={() => setAutostart(autostartStatus === 'disabled')}
             />
           </SettingRow>
           <SettingRow title="Start the app minimized to the system tray" inline>

new-ui/src/pages/full/SettingsPage/SettingsPage.tsx

@@ -0,0 +1,11 @@
+import { invoke } from '@tauri-apps/api/core';
+
+export type AutostartStatus = 'enabled' | 'disabled' | 'requiresApproval' | 'notFound';
+
+/** Read the OS login registration; no autostart preference is stored in AppConfig. */
+export const getAutostartStatus = (): Promise<AutostartStatus> =>
+  invoke<AutostartStatus>('get_autostart_status');
+
+/** Update the OS login registration and return its effective status. */
+export const setAutostartEnabled = (enabled: boolean): Promise<AutostartStatus> =>
+  invoke<AutostartStatus>('set_autostart_enabled', { enabled });

new-ui/src/shared/autostart.ts

@@ -185,6 +185,7 @@ objc2-app-kit = "0.3"
 objc2-foundation = "0.3"
 objc2-network-extension = "0.3"
 objc2-system-extensions = { version = "0.3", optional = true }
+objc2-service-management = { version = "0.3.2", default-features = false, features = ["std", "objc2", "objc2-foundation", "SMAppService"] }
 
 [target.'cfg(unix)'.dependencies]
 nix.workspace = true

src-tauri/Cargo.lock

@@ -45,9 +45,6 @@
     "core:window:allow-start-dragging",
     "core:window:allow-toggle-maximize",
     "core:webview:allow-print",
-    "autostart:allow-disable",
-    "autostart:allow-enable",
-    "autostart:allow-is-enabled",
     "deep-link:default",
     "fs:default",
     "fs:allow-write-text-file",

src-tauri/Cargo.toml

@@ -52,6 +52,8 @@ commands.allow = [
   "stop_global_logwatcher",
   "command_get_app_config",
   "command_set_app_config",
+  "get_autostart_status",
+  "set_autostart_enabled",
   "get_provisioning_config",
   "get_platform_header",
   "set_location_mfa_step_plan",

src-tauri/capabilities/default.json

@@ -0,0 +1,99 @@
+use serde::Serialize;
+
+/// Registration state reported by the operating system for launch at login.
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+pub enum AutostartStatus {
+    Enabled,
+    Disabled,
+    RequiresApproval,
+    NotFound,
+}
+
+#[cfg(target_os = "macos")]
+fn macos_service() -> objc2::rc::Retained<objc2_service_management::SMAppService> {
+    // SAFETY: mainAppService is an Objective-C class method returning an owned object.
+    unsafe { objc2_service_management::SMAppService::mainAppService() }
+}
+
+#[cfg(target_os = "macos")]
+fn macos_status(service: &objc2_service_management::SMAppService) -> AutostartStatus {
+    use objc2_service_management::SMAppServiceStatus;
+
+    // SAFETY: status reads the ServiceManagement registration for the main app.
+    match unsafe { service.status() } {
+        SMAppServiceStatus::Enabled => AutostartStatus::Enabled,
+        SMAppServiceStatus::NotRegistered => AutostartStatus::Disabled,
+        SMAppServiceStatus::RequiresApproval => AutostartStatus::RequiresApproval,
+        _ => AutostartStatus::NotFound,
+    }
+}
+
+#[tauri::command]
+pub fn get_autostart_status(app: tauri::AppHandle) -> Result<AutostartStatus, String> {
+    #[cfg(target_os = "macos")]
+    {
+        let _ = app;
+        Ok(macos_status(&macos_service()))
+    }
+    #[cfg(not(target_os = "macos"))]
+    {
+        use tauri_plugin_autostart::ManagerExt;
+
+        app.autolaunch()
+            .is_enabled()
+            .map(|enabled| {
+                if enabled {
+                    AutostartStatus::Enabled
+                } else {
+                    AutostartStatus::Disabled
+                }
+            })
+            .map_err(|error| error.to_string())
+    }
+}
+
+#[tauri::command]
+pub fn set_autostart_enabled(
+    app: tauri::AppHandle,
+    enabled: bool,
+) -> Result<AutostartStatus, String> {
+    #[cfg(target_os = "macos")]
+    {
+        let _ = app;
+        let service = macos_service();
+        let status = macos_status(&service);
+        if enabled && matches!(status, AutostartStatus::Disabled) {
+            // SAFETY: ServiceManagement registers the calling signed main application.
+            unsafe { service.registerAndReturnError() }
+                .map_err(|error| error.localizedDescription().to_string())?;
+        } else if !enabled
+            && matches!(
+                status,
+                AutostartStatus::Enabled | AutostartStatus::RequiresApproval
+            )
+        {
+            // SAFETY: ServiceManagement unregisters only this main application.
+            unsafe { service.unregisterAndReturnError() }
+                .map_err(|error| error.localizedDescription().to_string())?;
+        } else if matches!(status, AutostartStatus::NotFound) {
+            return Err("Main app login service is unavailable".into());
+        }
+        Ok(macos_status(&service))
+    }
+    #[cfg(not(target_os = "macos"))]
+    {
+        use tauri_plugin_autostart::ManagerExt;
+
+        if enabled {
+            app.autolaunch()
+                .enable()
+                .map_err(|error| error.to_string())?;
+        } else {
+            app.autolaunch()
+                .disable()
+                .map_err(|error| error.to_string())?;
+        }
+        get_autostart_status(app)
+    }
+}

src-tauri/permissions/default.toml

@@ -26,6 +26,7 @@ use crate::utils::sync_connections;
 use crate::{
     app_config::AppConfig,
     appstate::AppState,
+    autostart,
     commands::*,
     database::{
         handle_db_migrations,
@@ -162,7 +163,7 @@ async fn startup(app_handle: &AppHandle) {
 pub fn run_app() {
     info!("Starting Defguard client version {VERSION}");
 
-    let app = Builder::default()
+    let builder = Builder::default()
         .invoke_handler(tauri::generate_handler![
             all_locations,
             has_any_visible_locations,
@@ -190,6 +191,8 @@ pub fn run_app() {
             stop_global_logwatcher,
             command_get_app_config,
             command_set_app_config,
+            autostart::get_autostart_status,
+            autostart::set_autostart_enabled,
             get_provisioning_config,
             get_platform_header,
             get_posture_data,
@@ -255,11 +258,12 @@ pub fn run_app() {
             if !is_deep_link {
                 show_tray_or_full_view(app);
             }
-        }))
-        .plugin(tauri_plugin_autostart::init(
-            tauri_plugin_autostart::MacosLauncher::LaunchAgent,
-            None,
-        ))
+        }));
+
+    #[cfg(not(target_os = "macos"))]
+    let builder = builder.plugin(tauri_plugin_autostart::Builder::new().build());
+
+    let app = builder
         .plugin(tauri_plugin_deep_link::init())
         .plugin(tauri_plugin_dialog::init())
         .plugin(tauri_plugin_clipboard_manager::init())