Catch keychain's errSecUserCanceled

.github/workflows/lint.yml

@@ -1,5 +1,5 @@
 name: golangci-lint
-on: push
+on: pull_request
 jobs:
   golangci:
     strategy:

.github/workflows/test.yml

@@ -1,5 +1,5 @@
 name: Continuous Integration
-on: push
+on: pull_request
 jobs:
   linux:
     runs-on: ubuntu-latest

.gitignore

@@ -1 +1,2 @@
 .vagrant
+.idea

keychain.go

@@ -3,13 +3,26 @@
 
 package keyring
 
+/*
+#cgo LDFLAGS: -framework CoreFoundation -framework Security
+
+#include <CoreFoundation/CoreFoundation.h>
+#include <Security/Security.h>
+*/
+import "C"
 import (
 	"errors"
 	"fmt"
 
 	gokeychain "github.com/99designs/go-keychain"
 )
 
+// Extended error list that gokeychain doesn't catch
+var (
+	// ErrorUserCanceled corresponds to errSecUserCanceled result code
+	ErrorUserCanceled = gokeychain.Error(C.errSecUserCanceled)
+)
+
 type keychain struct {
 	path    string
 	service string
@@ -58,14 +71,23 @@ func (k *keychain) Get(key string) (Item, error) {
 
 	debugf("Querying keychain for service=%q, account=%q, keychain=%q", k.service, key, k.path)
 	results, err := gokeychain.QueryItem(query)
-	if err == gokeychain.ErrorItemNotFound || len(results) == 0 {
-		debugf("No results found")
-		return Item{}, ErrKeyNotFound
+	if err != nil {
+		switch err {
+		case ErrorUserCanceled:
+			debugf("Keychain access denied")
+			return Item{}, ErrAccessDenied
+		case gokeychain.ErrorItemNotFound:
+			debugf("Item not found in the keyring")
+			return Item{}, ErrKeyNotFound
+		default:
+			debugf("Error: %#v", err)
+			return Item{}, err
+		}
 	}
 
-	if err != nil {
-		debugf("Error: %#v", err)
-		return Item{}, err
+	if len(results) == 0 {
+		debugf("No results found")
+		return Item{}, ErrKeyNotFound
 	}
 
 	item := Item{

keyring.go

@@ -122,6 +122,9 @@ var ErrMetadataNeedsCredentials = errors.New("The keyring backend requires crede
 // ErrMetadataNotSupported is returned when Metadata is not available for the backend.
 var ErrMetadataNotSupported = errors.New("The keyring backend does not support metadata access")
 
+// ErrAccessDenied is returned by Keyring Get when access to Keychain is denied by the user
+var ErrAccessDenied = errors.New("Keyring backend access denied by user")
+
 var (
 	// Debug specifies whether to print debugging output.
 	Debug bool