Access to the Screen Recording API

[Aleksey28]

Image: macos-latest (20230618.1)

I try to run tests via TestCafe. To open browsers TestCafe uses testcafe-browser-tools. But testcafe-browser-tools needs access to the Screen Recording API. How can I give this access?

Without this access pop-up with an access request appears and an error is thrown.

There is my repo with an example: https://github.com/Aleksey28/testcafe-macos-safari-tests

Repro steps:

1. Fork repo
2. Run main workflow

foo.mov

[erik-bershel]

Hey @Aleksey28!
Theoretically, you can add additional permissions for anything to the TCC database right at runtime.
For example like this:

jobs:
  test:
    runs-on: macos-latest
    steps:
    - name: Add rows to the TCC.db
      run: |

        configure_user_tccdb () {
        local values=$1
        local dbPath="$HOME/Library/Application Support/com.apple.TCC/TCC.db"
        local sqlQuery="INSERT OR REPLACE INTO access VALUES($values);"
        sqlite3 "$dbPath" "$sqlQuery"
        }
        
        userValuesArray=(
          "'kTCCServiceAppleEvents','com.apple.Terminal',0,2,3,1,X'fade0c000000003000000001000000060000000200000012636f6d2e6170706c652e5465726d696e616c000000000003',NULL,0,'com.apple.systemevents',X'fade0c000000003400000001000000060000000200000016636f6d2e6170706c652e73797374656d6576656e7473000000000003',NULL,1591180478"
          "'kTCCServiceAppleEvents','com.apple.Terminal',0,2,3,1,X'fade0c000000003000000001000000060000000200000012636f6d2e6170706c652e5465726d696e616c000000000003',NULL,0,'com.apple.finder',X'fade0c000000002c00000001000000060000000200000010636f6d2e6170706c652e66696e64657200000003',NULL,1687438918"
          "'kTCCServiceAppleEvents','/usr/libexec/sshd-keygen-wrapper',1,2,3,1,X'fade0c000000003c0000000100000006000000020000001d636f6d2e6170706c652e737368642d6b657967656e2d7772617070657200000000000003',NULL,0,'com.apple.finder',X'fade0c000000002c00000001000000060000000200000010636f6d2e6170706c652e66696e64657200000003',NULL,1591357685"
          "'kTCCServiceAppleEvents','/usr/libexec/sshd-keygen-wrapper',1,2,3,1,X'fade0c000000003c0000000100000006000000020000001d636f6d2e6170706c652e737368642d6b657967656e2d7772617070657200000000000003',NULL,0,'com.apple.Terminal',X'fade0c000000003000000001000000060000000200000012636f6d2e6170706c652e5465726d696e616c000000000003',NULL,1650386089"
          "'kTCCServiceAppleEvents','/usr/libexec/sshd-keygen-wrapper',1,2,3,1,X'fade0c000000003c0000000100000006000000020000001d636f6d2e6170706c652e737368642d6b657967656e2d7772617070657200000000000003',NULL,0,'com.apple.systemevents',X'fade0c000000003400000001000000060000000200000016636f6d2e6170706c652e73797374656d6576656e7473000000000003',NULL,1644564201"
          "'kTCCServiceAppleEvents','/bin/bash',1,2,3,1,NULL,NULL,0,'com.apple.systemevents',X'fade0c000000003400000001000000060000000200000016636f6d2e6170706c652e73797374656d6576656e7473000000000003',NULL,1591532620"
          "'kTCCServiceAppleEvents','/bin/bash',1,2,3,1,NULL,NULL,0,'com.apple.finder',X'fade0c000000002c00000001000000060000000200000010636f6d2e6170706c652e66696e64657200000003',NULL,1592919552"
          "'kTCCServiceAppleEvents','/bin/bash',1,2,3,1,NULL,NULL,0,'com.apple.Terminal',X'fade0c000000003000000001000000060000000200000012636f6d2e6170706c652e5465726d696e616c000000000003',NULL,1592919555"
         
        )

        for values in "${userValuesArray[@]}"; do
          configure_user_tccdb "$values"
        done

To simplify the process, I recommend taking a snapshot of the database row from the real machine where the required permissions were granted to the specified client.

[Aleksey28]

Hi @erik-bershel,

Thank you for the replay.
I added

"'kTCCServiceAppleEvents','com.devexpress.testcafe-browser-tools',0,2,3,1,X'fade0c0000000068000000010000000700000007000000080000001443fa4ca5141baeda21aeca1f50894673b440d4690000000800000014f8afcf6e69791b283e55bd0b03e39e422745770e0000000800000014bf4fc1aed64c871a49fc6bc9dd3878ce5d4d17c6',NULL,0,'com.apple.Safari',X'fade0c000000002c00000001000000060000000200000010636f6d2e6170706c652e53616661726900000003',NULL,1687952810"

and now the top pop-up doesn't appear, but another one still ruins the task. look at the video.

There weren't other rows for this app in the database of the real machine, so I decided to add these rows:

"'kTCCServiceAppleEvents','com.devexpress.testcafe-browser-tools',0,2,3,1,X'fade0c0000000068000000010000000700000007000000080000001443fa4ca5141baeda21aeca1f50894673b440d4690000000800000014f8afcf6e69791b283e55bd0b03e39e422745770e0000000800000014bf4fc1aed64c871a49fc6bc9dd3878ce5d4d17c6',NULL,0,'com.apple.systemevents',X'fade0c000000002c00000001000000060000000200000010636f6d2e6170706c652e53616661726900000003',NULL,1687952810"
"'kTCCServiceScreenCapture','com.devexpress.testcafe-browser-tools',0,2,3,1,X'fade0c0000000068000000010000000700000007000000080000001443fa4ca5141baeda21aeca1f50894673b440d4690000000800000014f8afcf6e69791b283e55bd0b03e39e422745770e0000000800000014bf4fc1aed64c871a49fc6bc9dd3878ce5d4d17c6',NULL,0,'com.apple.Safari',X'fade0c000000002c00000001000000060000000200000010636f6d2e6170706c652e53616661726900000003',NULL,1687952810"
"'kTCCServiceScreenCapture','com.devexpress.testcafe-browser-tools',0,2,3,1,X'fade0c0000000068000000010000000700000007000000080000001443fa4ca5141baeda21aeca1f50894673b440d4690000000800000014f8afcf6e69791b283e55bd0b03e39e422745770e0000000800000014bf4fc1aed64c871a49fc6bc9dd3878ce5d4d17c6',NULL,0,'com.apple.systemevents',X'fade0c000000002c00000001000000060000000200000010636f6d2e6170706c652e53616661726900000003',NULL,1687952810"

but it didn't help.

Do you know what should I add more?

foo.mov

[erik-bershel]

@Aleksey28 hey

database of the real machine

Which one? There are two TCC.db. I can guess that the second permission is being written to the system database (Library/Application Support/com.apple.TCC/TCC.db). Please check and add it too.

Example of method for the pipeline with the same structure:

  configure_sys_tccdb () {
  local values=$1
  local dbPath="/Library/Application Support/com.apple.TCC/TCC.db"
  local sqlQuery="INSERT OR REPLACE INTO access VALUES($values);"
  sudo sqlite3 "$dbPath" "$sqlQuery" #wouldn't work without sudo
  }

[Aleksey28]

Okay, I see. I managed to change both databases in the real machine. But it looks like there isn't access to the system database in the GitHub image. Here is my script:

configure_tccdb () {
  local values=$1
  local dbPath="$HOME/Library/Application Support/com.apple.TCC/TCC.db"
  local systemDbPath="/Library/Application Support/com.apple.TCC/TCC.db"
  local sqlQuery="INSERT OR REPLACE INTO access VALUES($values);"
  sudo sqlite3 "$dbPath" "$sqlQuery"
  sudo sqlite3 "$systemDbPath" "$sqlQuery"
}

userValuesArray=(
  "'kTCCServiceAppleEvents','com.devexpress.testcafe-browser-tools',0,2,3,1,X'fade0c0000000068000000010000000700000007000000080000001443fa4ca5141baeda21aeca1f50894673b440d4690000000800000014f8afcf6e69791b283e55bd0b03e39e422745770e0000000800000014bf4fc1aed64c871a49fc6bc9dd3878ce5d4d17c6',NULL,0,'com.apple.systemevents',X'fade0c000000002c00000001000000060000000200000010636f6d2e6170706c652e53616661726900000003',NULL,1687952810"
  "'kTCCServiceScreenCapture','com.devexpress.testcafe-browser-tools',0,2,3,1,X'fade0c0000000068000000010000000700000007000000080000001443fa4ca5141baeda21aeca1f50894673b440d4690000000800000014f8afcf6e69791b283e55bd0b03e39e422745770e0000000800000014bf4fc1aed64c871a49fc6bc9dd3878ce5d4d17c6',NULL,0,'UNUSED',NULL,0,1687952810"
)

for values in "${userValuesArray[@]}"; do
  configure_user_tccdb "$values"
done

I found a similar issue #1567. Based on this issue @miketimofeev added permission for the /bin/bash in the /Library/Application Support/com.apple.TCC/TCC.db

Please, could you do the same for com.devexpress.testcafe-browser-tools with values from the command above? I need only kTCCServiceScreenCapture permission. Permission for kTCCServiceAppleEvents works in the db in the $HOME repo.

[Aleksey28]

It's strange I copied and pasted script from your comment and got error: https://github.com/Aleksey28/testcafe-macos-safari-tests/actions/runs/5410259363/jobs/9831460111#step:2:1

[Aleksey28]

@erik-bershel, I figured out the problem. It works fine on macos-13, but on macos-12 or macos-latest doesn't.

[erik-bershel]

@Aleksey28 sounds interesting. I'll take a look.

[erik-bershel]

@Aleksey28 my mistake. SIP disabled for macOS 13 only. Please open a feature request in runner-images to add the row into TCC db.

[Aleksey28]

Okay. At least I can run tests on macos-13. Thank you for your time. I really appreciate your help.

[samus-aran]

We're locking this discussion because it has not had recent activity and/or other members have asked for more information to assist you but received no response. Thank you for helping us maintain a productive and tidy community for all our members.