mirror of
https://github.com/yattee/yattee.git
synced 2026-10-23 13:12:53 +00:00
9fd0a71035
Yattee 2 keys credentials by instance UUID with no notion of which Apple account they belong to, and reads them back with SynchronizableAny. Apple documents that Keychain data may stay on device when a user signs out and chooses to keep it, so whoever signs in next would be served the previous user's credential - guaranteed for migrated accounts, since local instances survive the switch and the migrated account UUID is deterministically the instance UUID. Credentials are now keyed "<identityScope>|<accountID>", where the scope is the CloudKit user record (identical across a user's devices, so iCloud Keychain sync still works). Usernames get the same scope and live beside the credential, keeping login identifiers out of synced metadata. The legacy unscoped item is never adopted automatically. A strict kSecAttrSynchronizable == true query was the candidate discriminator for "this secret belongs to the current Apple account", but measured on iPadOS 27.0 a retained item keeps the attribute and still matches that query with no Apple account signed in at all - the flag records what was once requested, not live iCloud Keychain membership. Reads therefore never fall back to the legacy key; adoption is an explicit user action that copies the item, verifies the scoped read-back, then records a marker bound to the identity and a salted fingerprint of the secret. The legacy item is retained, because deleting a synchronizable item propagates and would log out devices still on the previous release mid-rollout. Deleting it later needs all three of: a marker on this device, matching identity, and the item still holding the adopted secret. The instance-keyed path is untouched, so no shipping call site changes behavior. BasicAuthCredentialsManager stays instance-keyed - proxy auth belongs to the instance, not to a user account. While the scope is unresolved (first launch under a new Apple account, CloudKit unreachable) reads report "can't tell yet" via isScopeResolved rather than "signed out", and writes are refused rather than guessing a scope. Login state is cached per scope so one identity's cache can never answer for another. Also adds the debug-only harness the measurement was taken with, under Advanced > Developer > Experiments.