Mirrored_Repos/yattee
1
0
Fork 0
mirror of https://github.com/yattee/yattee.git synced 2026-10-30 16:37:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Say why a matching secret can only be the one that was adopted

Browse Source
This commit is contained in:
Arkadiusz Fal
2026-09-08 23:10:27 +02:00
parent bb46ac3e32
commit 0bfacaa497
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
Yattee/Services/Credentials/AccountKeychainCredentials.swift
View File

@@ -388,6 +388,17 @@ final class AccountKeychainCredentials {
let targetKey = KeychainCredentialStore.credentialKey(scope: scope, accountID: accountID) let targetKey = KeychainCredentialStore.credentialKey(scope: scope, accountID: accountID)
// Equality with the marker's fingerprint is taken as proof that this
// value *is* the legacy secret, however it got here — so it is treated
// as adopted and kept device-local. That rests on both supported
// backends minting a fresh secret for every login: Invidious issues a
// per-session SID, and a Piped JWT differs per issue through its `iat`.
// Two separate logins therefore cannot collide on one value, so a match
// can only be the adopted copy rather than a sign-in that happens to
// look like it. A future backend that can hand back an identical
// credential for a separate login breaks that reasoning and needs a
// different discriminator here — the fingerprint alone would then
// misread a genuine login as adopted and keep it off iCloud Keychain.
if let stored = store.value(forKey: targetKey), if let stored = store.value(forKey: targetKey),
markers.hasAdopted( markers.hasAdopted(
service: store.service, service: store.service,