mirror of
https://github.com/yattee/yattee.git
synced 2026-10-23 13:12:53 +00:00
313403cc1e
Third review pass. adoptCurrentIdentity() treated a nil ubiquityIdentityToken as sign-out and scoped credentials to "local". But Foundation also returns nil when iCloud Drive is unavailable or switched off, and Yattee declares only the CloudKit service with no ubiquity container, so the token tracks iCloud Drive state rather than the account. In that configuration two different signed-in Apple accounts both resolved to "local" and shared one credential namespace - since Keychain items survive an account switch, account B could then read account A's retained credential. That is the precise failure this whole change exists to prevent. A nil token now means unresolved, and CloudKit's account status settles it during resolution: noAccount scopes to local, available proceeds to the user-record lookup, anything else stays unresolved and retries. A scope resolved without a token is not cached, because there is no key that could be trusted to mean this account. Adoption markers are now namespaced by Keychain service. Both credential managers share one marker store and an instance UUID can outlive a change of backend, so adopting an Invidious credential could suppress the Piped offer for the same instance and point deletion at the wrong secret. Writing the account-status branch also surfaced a Swift trap: an unqualified `break` inside the switch left only the switch and fell through to the user-record lookup, resolving a scope on an undetermined account status. The loop is labelled now, and the test that caught it is included.