mirror of
https://github.com/yattee/yattee.git
synced 2026-10-24 13:42:54 +00:00
Yattee 2 keys credentials by instance UUID with no notion of which Apple account they belong to, and reads them back with SynchronizableAny. Apple documents that Keychain data may stay on device when a user signs out and chooses to keep it, so whoever signs in next would be served the previous user's credential - guaranteed for migrated accounts, since local instances survive the switch and the migrated account UUID is deterministically the instance UUID. Credentials are now keyed "<identityScope>|<accountID>", where the scope is the CloudKit user record (identical across a user's devices, so iCloud Keychain sync still works). Usernames get the same scope and live beside the credential, keeping login identifiers out of synced metadata. The legacy unscoped item is never adopted automatically. A strict kSecAttrSynchronizable == true query was the candidate discriminator for "this secret belongs to the current Apple account", but measured on iPadOS 27.0 a retained item keeps the attribute and still matches that query with no Apple account signed in at all - the flag records what was once requested, not live iCloud Keychain membership. Reads therefore never fall back to the legacy key; adoption is an explicit user action that copies the item, verifies the scoped read-back, then records a marker bound to the identity and a salted fingerprint of the secret. The legacy item is retained, because deleting a synchronizable item propagates and would log out devices still on the previous release mid-rollout. Deleting it later needs all three of: a marker on this device, matching identity, and the item still holding the adopted secret. The instance-keyed path is untouched, so no shipping call site changes behavior. BasicAuthCredentialsManager stays instance-keyed - proxy auth belongs to the instance, not to a user account. While the scope is unresolved (first launch under a new Apple account, CloudKit unreachable) reads report "can't tell yet" via isScopeResolved rather than "signed out", and writes are refused rather than guessing a scope. Login state is cached per scope so one identity's cache can never answer for another. Also adds the debug-only harness the measurement was taken with, under Advanced > Developer > Experiments.
75 lines
2.6 KiB
Swift
75 lines
2.6 KiB
Swift
//
|
|
// Account.swift
|
|
// Yattee
|
|
//
|
|
// A single sign-in on a backend instance. One instance may hold several.
|
|
//
|
|
|
|
import Foundation
|
|
|
|
/// A user's login on an instance.
|
|
///
|
|
/// Yattee 2 collapsed v1's multi-account model into "one instance = at most one
|
|
/// credential" (`Instance.usesAccountLogin` plus a Keychain item keyed by the
|
|
/// instance's UUID). `Account` restores multi-login: the instance describes the
|
|
/// *server*, the account describes *who is signed in to it*.
|
|
///
|
|
/// The login identifier (username/email) is deliberately **not** stored here —
|
|
/// it lives in the Keychain beside the credential, so synced metadata never
|
|
/// carries account identifiers. Only `displayName` is a synced label.
|
|
///
|
|
/// `type` is not stored either: it is derived by resolving `instanceID` through
|
|
/// `InstancesManager`, so an instance that changes type can never disagree with
|
|
/// its accounts.
|
|
struct Account: Identifiable, Codable, Hashable, Sendable {
|
|
let id: UUID
|
|
let instanceID: UUID
|
|
|
|
/// User-set label. The only name that syncs.
|
|
var displayName: String?
|
|
|
|
let dateAdded: Date
|
|
|
|
/// Bumped on every user edit — supplies the ordering for conflict
|
|
/// resolution, which never relies on CloudKit modification dates.
|
|
var updatedAt: Date
|
|
|
|
init(
|
|
id: UUID = UUID(),
|
|
instanceID: UUID,
|
|
displayName: String? = nil,
|
|
dateAdded: Date = Date(),
|
|
updatedAt: Date = Date()
|
|
) {
|
|
self.id = id
|
|
self.instanceID = instanceID
|
|
self.displayName = displayName
|
|
self.dateAdded = dateAdded
|
|
self.updatedAt = updatedAt
|
|
}
|
|
|
|
/// The account synthesized for an instance that was signed in before
|
|
/// multi-account support existed.
|
|
///
|
|
/// The account's `id` is deliberately the **instance's** UUID: at most one
|
|
/// credential ever existed per instance, so reusing the UUID makes the
|
|
/// migration deterministic across devices — two devices migrating
|
|
/// independently produce the identical record name, which merges per-record
|
|
/// instead of duplicating.
|
|
static func migrated(from instanceID: UUID, dateAdded: Date = Date()) -> Account {
|
|
Account(
|
|
id: instanceID,
|
|
instanceID: instanceID,
|
|
displayName: nil,
|
|
dateAdded: dateAdded,
|
|
// Epoch-old: any explicit user edit on any device outranks a
|
|
// migration write regardless of arrival order.
|
|
updatedAt: Date(timeIntervalSince1970: 0)
|
|
)
|
|
}
|
|
|
|
/// Whether this account was produced by the legacy migration rather than an
|
|
/// explicit sign-in.
|
|
var isMigrated: Bool { id == instanceID }
|
|
}
|