mirror of
https://github.com/yattee/yattee.git
synced 2026-10-23 21:22:53 +00:00
9fd0a71035
Yattee 2 keys credentials by instance UUID with no notion of which Apple account they belong to, and reads them back with SynchronizableAny. Apple documents that Keychain data may stay on device when a user signs out and chooses to keep it, so whoever signs in next would be served the previous user's credential - guaranteed for migrated accounts, since local instances survive the switch and the migrated account UUID is deterministically the instance UUID. Credentials are now keyed "<identityScope>|<accountID>", where the scope is the CloudKit user record (identical across a user's devices, so iCloud Keychain sync still works). Usernames get the same scope and live beside the credential, keeping login identifiers out of synced metadata. The legacy unscoped item is never adopted automatically. A strict kSecAttrSynchronizable == true query was the candidate discriminator for "this secret belongs to the current Apple account", but measured on iPadOS 27.0 a retained item keeps the attribute and still matches that query with no Apple account signed in at all - the flag records what was once requested, not live iCloud Keychain membership. Reads therefore never fall back to the legacy key; adoption is an explicit user action that copies the item, verifies the scoped read-back, then records a marker bound to the identity and a salted fingerprint of the secret. The legacy item is retained, because deleting a synchronizable item propagates and would log out devices still on the previous release mid-rollout. Deleting it later needs all three of: a marker on this device, matching identity, and the item still holding the adopted secret. The instance-keyed path is untouched, so no shipping call site changes behavior. BasicAuthCredentialsManager stays instance-keyed - proxy auth belongs to the instance, not to a user account. While the scope is unresolved (first launch under a new Apple account, CloudKit unreachable) reads report "can't tell yet" via isScopeResolved rather than "signed out", and writes are refused rather than guessing a scope. Login state is cached per scope so one identity's cache can never answer for another. Also adds the debug-only harness the measurement was taken with, under Advanced > Developer > Experiments.
64 lines
2.7 KiB
Swift
64 lines
2.7 KiB
Swift
//
|
|
// AccountCredentialsManager.swift
|
|
// Yattee
|
|
//
|
|
// Account-keyed credential storage — the multi-login replacement for the
|
|
// instance-keyed InstanceCredentialsManager.
|
|
//
|
|
|
|
import Foundation
|
|
|
|
/// Credential storage keyed by `Account`, not by `Instance`.
|
|
///
|
|
/// Adopted by `InvidiousCredentialsManager` and `PipedCredentialsManager`.
|
|
/// `BasicAuthCredentialsManager` deliberately does **not** adopt it and keeps
|
|
/// `InstanceCredentialsManager`: HTTP Basic auth is a property of the instance
|
|
/// (or the reverse proxy in front of it), not of a user account, and a single
|
|
/// proxy credential covers every account on that instance.
|
|
@MainActor
|
|
protocol AccountCredentialsManager: AnyObject, Observable {
|
|
/// Accounts with a stored credential under the **current** identity scope.
|
|
var loggedInAccountIDs: Set<UUID> { get }
|
|
|
|
/// Whether the identity scope has been resolved yet.
|
|
///
|
|
/// While `false`, every read below reports "no credential" because the app
|
|
/// cannot yet tell which scope to look in. Callers must render that as
|
|
/// *temporarily unavailable*, never as "signed out" — correcting state on
|
|
/// it would discard a perfectly good login.
|
|
var isScopeResolved: Bool { get }
|
|
|
|
func setCredential(_ credential: String, for account: Account)
|
|
func credential(for account: Account) -> String?
|
|
func deleteCredential(for account: Account)
|
|
|
|
/// The login identifier the user typed. Kept in the Keychain beside the
|
|
/// credential so it never enters synced metadata.
|
|
func setUsername(_ username: String, for account: Account)
|
|
func username(for account: Account) -> String?
|
|
|
|
func isLoggedIn(for account: Account) -> Bool
|
|
func refreshLoginStatus(for account: Account)
|
|
|
|
// MARK: - Legacy adoption
|
|
|
|
/// Whether a pre-revamp credential for this account's instance exists on
|
|
/// this device and has not been adopted by the current identity.
|
|
///
|
|
/// Never acted on automatically: a retained Keychain item carries no proof
|
|
/// of which Apple account it belonged to (measured — see
|
|
/// ``CredentialIdentityScope``), so adoption is always a deliberate user
|
|
/// action.
|
|
func hasAdoptableLegacyCredential(for account: Account) -> Bool
|
|
|
|
/// Copies the legacy item into this account's scoped key after the user
|
|
/// asks for it. Returns whether the copy verified.
|
|
@discardableResult
|
|
func adoptLegacyCredential(for account: Account) -> Bool
|
|
|
|
/// Deletes the unscoped legacy item **only** if this identity adopted it
|
|
/// and it still holds the adopted secret. Called when an account is really
|
|
/// deleted, never on mere absence.
|
|
func deleteLegacyCredentialIfOwned(for account: Account)
|
|
}
|