mirror of
https://github.com/yattee/yattee.git
synced 2026-10-23 21:22:53 +00:00
00a298b09f
Sixth review pass, both findings in the tokenless path the fourth pass introduced. The staleness guard compared fingerprints, which is useless when there is no ubiquity token: nil before the switch and nil after it, so a user-record lookup started under account A was accepted as current after CKAccountChanged had already announced B. The scope then read as resolved, the pending-resolve replay was skipped because it only runs while unresolved, and B was left pointed at A's credential namespace. Every async path now captures a generation counter that every observed account change bumps, and refuses to apply a result across it. Foreground revalidation also kept serving the old tokenless scope across both awaits, and indefinitely when the account status came back undetermined - so a switch that happened while the app was suspended could hand A's retained credentials to B. The scope is now dropped before the confirmation rather than compared after it, which also let the bespoke revalidation logic collapse into resolve(), where the signed-out, signed-in and undetermined cases are already handled. A tokenless setup briefly reports "can't tell yet" on each activation; the tri-state UI covers that, and the alternative traded a real cross-account disclosure for the convenience.