mirror of
https://github.com/yattee/yattee.git
synced 2026-10-24 05:32:53 +00:00
395b8eb083
Storing checked that the identity scope was resolved, but not that it was still the one the login was made under. Credentials are filed per identity, and the round trip leaves room for the scope to move — the account obtained here would then be written into somebody else's namespace and synced to their Keychain. Only a move between two named identities counts. Unresolved at either end is left to the storing side, which already refuses to write under a scope it cannot name; rejecting it here as well would turn an ordinary sign-in that began before iCloud settled — or a tokenless scope revalidating on activation, which it does every time — into a failed login.