Mirrored_Repos/yattee
1
0
Fork 0
mirror of https://github.com/yattee/yattee.git synced 2026-10-28 07:27:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Let only the adopting account retire its marker

Browse Source 
Found on the iPad: after signing a second login into an instance, its
migrated account could no longer retire the unscoped legacy item when it
was deleted, and the instance was left still claiming a pre-revamp login.

Storing a credential retires the adoption marker, but it matched on
service, instance and identity only. An instance holds several logins, so
a sibling sign-in silently withdrew the migrated account's claim on a
secret it had nothing to do with. After that the legacy item outlived the
account that adopted it, and could be adopted a second time.

Erring that way costs nothing — an item that is not deleted is an item
nobody is logged out of — but the marker already carries the account it
was written for, and deletion authority already checks it. Retiring it
now matches on the same thing.
This commit is contained in:
Arkadiusz Fal
2026-09-01 23:52:59 +02:00
parent 1e92db25f0
commit abd0f8ddbb
3 changed files with 61 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
Yattee/Services/Credentials/AccountKeychainCredentials.swift
View File

@@ -92,13 +92,22 @@ final class AccountKeychainCredentials {
loginsByScope[scope, default: []].insert(account.id)
// Whatever was adopted here is gone, replaced by a login the user just
// proved they hold. Leaving the marker would keep this account out of
// the resync that follows the iCloud toggle, so the new credential
// would stay on this device and every other one would show an account
// it never receives a login for. It would also let a deletion retire an
// Whatever *this account* adopted is gone, replaced by a login the user
// just proved they hold. Leaving the marker would keep it out of the
// resync that follows the iCloud toggle, so the new credential would
// stay on this device and every other one would show an account it
// never receives a login for. It would also let a deletion retire an
// unscoped item this account no longer has anything to do with.
markers.removeMarker(service: store.service, instanceID: account.instanceID, scope: scope)
//
// A sibling's marker is left strictly alone: signing a second login
// into the same instance says nothing about the account that adopted
// that instance's pre-revamp secret.
markers.removeMarker(
service: store.service,
instanceID: account.instanceID,
accountID: account.id,
scope: scope
)
LoggingService.shared.info(
"Stored \(credentialNoun)",
@@ -412,7 +421,12 @@ final class AccountKeychainCredentials {
}
store.delete(key: legacyKey)
markers.removeMarker(service: store.service, instanceID: account.instanceID, scope: scope)
markers.removeMarker(
service: store.service,
instanceID: account.instanceID,
accountID: account.id,
scope: scope
)
LoggingService.shared.info(
"Deleted the legacy \(credentialNoun) alongside its account",

15
Yattee/Services/Credentials/CredentialAdoptionMarker.swift
View File

@@ -109,9 +109,20 @@ final class CredentialAdoptionMarkerStore {
save(all)
}
func removeMarker(service: String, instanceID: UUID, scope: String) {
/// Retires the marker for one account.
///
/// Scoped to `accountID` as well as the instance: an instance can hold
/// several logins, and only the account that actually adopted the legacy
/// secret may retire its marker. Matching on the instance alone let a
/// *sibling* sign-in clear it, which silently withdrew the migrated
/// account's claim on the unscoped item — after that its deletion could
/// no longer retire the legacy secret, and it could re-adopt it.
func removeMarker(service: String, instanceID: UUID, accountID: UUID, scope: String) {
save(markers().filter {
!($0.service == service && $0.instanceID == instanceID && $0.identityScope == scope)
!($0.service == service
&& $0.instanceID == instanceID
&& $0.accountID == accountID
&& $0.identityScope == scope)
})
}