Hammerspoon config for auto-typing passwords from the macOS Keychain

init.lua

function password_from_keychain(service)
    -- 'service' should be saved in the login keychain
    local cmd = "/usr/bin/security 2>&1 >/dev/null find-generic-password -gs '" .. service .. "' | sed -En '/^password: / s,^password: \"(.*)\"$,\\1,p'"

    local handle = io.popen(cmd)
    local result = handle:read("*a")
    handle:close()

    return (result:gsub("^%s*(.-)%s*$", "%1"))
end

function type_2fa_pin(with_return)
    hs.eventtap.keyStrokes(password_from_keychain("2fa pin"))

    if with_return then
        hs.eventtap.keyStroke({}, hs.keycodes.map["return"])
    end
end

-- type 2fa pin on F19
hs.hotkey.bind({}, "f19", "2fa pin", function() type_2fa_pin(true) end)
-- … and without ⏎ for manually concatenating yubikey token
hs.hotkey.bind({"shift"}, "f19", "2fa pin", type_2fa_pin)

-- same as above, but for use with the internal keyboard, which doesn't have F19
hs.hotkey.bind({"ctrl", "option", "cmd"}, "f12", "2fa pin", function() type_2fa_pin(true) end)
hs.hotkey.bind({"shift", "ctrl", "option", "cmd"}, "f12", "2fa pin", type_2fa_pin)