Show error and troubleshoot dialog when lacking full disk access

Author: raksooo

Diff for: gui/locales/messages.pot

@@ -1086,6 +1086,10 @@ msgctxt "notifications"
 msgid "Disconnected and unsecure"
 msgstr ""
 
+msgctxt "notifications"
+msgid "Failed to enable split tunneling."
+msgstr ""
+
 msgctxt "notifications"
 msgid "Failed to enable split tunneling. Please try again or disable it."
 msgstr ""
@@ -1682,6 +1686,14 @@ msgctxt "tray-icon-tooltip"
 msgid "Connecting. %(location)s"
 msgstr ""
 
+msgctxt "troubleshoot"
+msgid "Enable “Full Disk Access” for “Mullvad VPN” in the macOS system settings."
+msgstr ""
+
+msgctxt "troubleshoot"
+msgid "Failed to enable split tunneling. This is because the app is missing system permissions. What you can do:"
+msgstr ""
+
 msgctxt "troubleshoot"
 msgid "If these steps do not work please send a problem report."
 msgstr ""
@@ -1690,6 +1702,10 @@ msgctxt "troubleshoot"
 msgid "Make sure you have NF tables support."
 msgstr ""
 
+msgctxt "troubleshoot"
+msgid "Open system settings"
+msgstr ""
+
 msgctxt "troubleshoot"
 msgid "This error can happen when something other than Mullvad is actively updating the DNS."
 msgstr ""

Diff for: gui/src/main/daemon-rpc.ts

@@ -1047,10 +1047,9 @@ function convertFromTunnelStateError(state: grpcTypes.ErrorState.AsObject): Erro
         cause: ErrorStateCause.splitTunnelError,
       };
     case grpcTypes.ErrorState.Cause.NEED_FULL_DISK_PERMISSIONS:
-      // TODO: handle correctly
       return {
         ...baseError,
-        cause: ErrorStateCause.splitTunnelError,
+        cause: ErrorStateCause.needFullDiskPermissions,
       };
     case grpcTypes.ErrorState.Cause.VPN_PERMISSION_DENIED:
       // VPN_PERMISSION_DENIED is only ever created on Android

Diff for: gui/src/main/user-interface.ts

@@ -74,12 +74,20 @@ export default class UserInterface implements WindowControllerDelegate {
     });
 
     IpcMainEventChannel.app.handleShowLaunchDaemonSettings(async () => {
+      try {
+        await execAsync('open x-apple.systempreferences:com.apple.LoginItems-Settings.extension');
+      } catch (error) {
+        log.error(`Failed to open launch daemon settings: ${error}`);
+      }
+    });
+
+    IpcMainEventChannel.app.handleShowFullDiskAccessSettings(async () => {
       try {
         await execAsync(
-          'open -W x-apple.systempreferences:com.apple.LoginItems-Settings.extension',
+          'open "x-apple.systempreferences:com.apple.preference.security?Privacy_AllFiles"',
         );
       } catch (error) {
-        log.error(`Failed to open launch daemon settings: ${error}`);
+        log.error(`Failed to open Full Disk Access settings: ${error}`);
       }
     });
   }

Diff for: gui/src/renderer/app.tsx

@@ -529,6 +529,10 @@ export default class AppRenderer {
     await IpcRendererEventChannel.app.showLaunchDaemonSettings();
   }
 
+  public showFullDiskAccessSettings = async () => {
+    await IpcRendererEventChannel.app.showFullDiskAccessSettings();
+  };
+
   public async sendProblemReport(
     email: string,
     message: string,

Diff for: gui/src/renderer/components/NotificationArea.tsx

@@ -43,6 +43,8 @@ interface IProps {
 }
 
 export default function NotificationArea(props: IProps) {
+  const { showFullDiskAccessSettings } = useAppContext();
+
   const account = useSelector((state: IReduxState) => state.account);
   const locale = useSelector((state: IReduxState) => state.userInterface.locale);
   const tunnelState = useSelector((state: IReduxState) => state.connection.status);
@@ -65,7 +67,7 @@ export default function NotificationArea(props: IProps) {
       blockWhenDisconnected,
       hasExcludedApps,
     }),
-    new ErrorNotificationProvider({ tunnelState, hasExcludedApps }),
+    new ErrorNotificationProvider({ tunnelState, hasExcludedApps, showFullDiskAccessSettings }),
     new InconsistentVersionNotificationProvider({ consistent: version.consistent }),
     new UnsupportedVersionNotificationProvider(version),
   ];
@@ -168,20 +170,40 @@ function NotificationActionWrapper(props: INotificationActionWrapperProps) {
     }
   }
 
+  const problemReportButton = troubleshootInfo?.buttons ? (
+    <AppButton.BlueButton key="problem-report" onClick={goToProblemReport}>
+      {messages.pgettext('in-app-notifications', 'Send problem report')}
+    </AppButton.BlueButton>
+  ) : (
+    <AppButton.GreenButton key="problem-report" onClick={goToProblemReport}>
+      {messages.pgettext('in-app-notifications', 'Send problem report')}
+    </AppButton.GreenButton>
+  );
+
+  let buttons = [
+    problemReportButton,
+    <AppButton.BlueButton key="back" onClick={closeTroubleshootInfo}>
+      {messages.gettext('Back')}
+    </AppButton.BlueButton>,
+  ];
+
+  if (troubleshootInfo?.buttons) {
+    const actionButtons = troubleshootInfo.buttons.map((button) => (
+      <AppButton.GreenButton key={button.label} onClick={button.action}>
+        {button.label}
+      </AppButton.GreenButton>
+    ));
+
+    buttons = actionButtons.concat(buttons);
+  }
+
   return (
     <>
       <NotificationActions>{actionComponent}</NotificationActions>
       <ModalAlert
         isOpen={troubleshootInfo !== undefined}
         type={ModalAlertType.info}
-        buttons={[
-          <AppButton.GreenButton key="problem-report" onClick={goToProblemReport}>
-            {messages.pgettext('in-app-notifications', 'Send problem report')}
-          </AppButton.GreenButton>,
-          <AppButton.BlueButton key="back" onClick={closeTroubleshootInfo}>
-            {messages.gettext('Back')}
-          </AppButton.BlueButton>,
-        ]}
+        buttons={buttons}
         close={closeTroubleshootInfo}>
         <ModalMessage>{troubleshootInfo?.details}</ModalMessage>
         <ModalMessage>

Diff for: gui/src/shared/daemon-rpc-types.ts

@@ -48,6 +48,7 @@ export enum ErrorStateCause {
   tunnelParameterError,
   isOffline,
   splitTunnelError,
+  needFullDiskPermissions,
 }
 
 export enum AuthFailedError {
@@ -71,7 +72,8 @@ export type ErrorState =
         | ErrorStateCause.setDnsError
         | ErrorStateCause.startTunnelError
         | ErrorStateCause.isOffline
-        | ErrorStateCause.splitTunnelError;
+        | ErrorStateCause.splitTunnelError
+        | ErrorStateCause.needFullDiskPermissions;
       blockingError?: FirewallPolicyError;
     }
   | {

Diff for: gui/src/shared/ipc-schema.ts

@@ -162,6 +162,7 @@ export const ipcSchema = {
     openUrl: invoke<string, void>(),
     showOpenDialog: invoke<Electron.OpenDialogOptions, Electron.OpenDialogReturnValue>(),
     showLaunchDaemonSettings: invoke<void, void>(),
+    showFullDiskAccessSettings: invoke<void, void>(),
     getPathBaseName: invoke<string, string>(),
   },
   tunnel: {