mirror of
https://github.com/yattee/yattee.git
synced 2026-10-28 07:27:18 +00:00
9fd0a71035
Yattee 2 keys credentials by instance UUID with no notion of which Apple account they belong to, and reads them back with SynchronizableAny. Apple documents that Keychain data may stay on device when a user signs out and chooses to keep it, so whoever signs in next would be served the previous user's credential - guaranteed for migrated accounts, since local instances survive the switch and the migrated account UUID is deterministically the instance UUID. Credentials are now keyed "<identityScope>|<accountID>", where the scope is the CloudKit user record (identical across a user's devices, so iCloud Keychain sync still works). Usernames get the same scope and live beside the credential, keeping login identifiers out of synced metadata. The legacy unscoped item is never adopted automatically. A strict kSecAttrSynchronizable == true query was the candidate discriminator for "this secret belongs to the current Apple account", but measured on iPadOS 27.0 a retained item keeps the attribute and still matches that query with no Apple account signed in at all - the flag records what was once requested, not live iCloud Keychain membership. Reads therefore never fall back to the legacy key; adoption is an explicit user action that copies the item, verifies the scoped read-back, then records a marker bound to the identity and a salted fingerprint of the secret. The legacy item is retained, because deleting a synchronizable item propagates and would log out devices still on the previous release mid-rollout. Deleting it later needs all three of: a marker on this device, matching identity, and the item still holding the adopted secret. The instance-keyed path is untouched, so no shipping call site changes behavior. BasicAuthCredentialsManager stays instance-keyed - proxy auth belongs to the instance, not to a user account. While the scope is unresolved (first launch under a new Apple account, CloudKit unreachable) reads report "can't tell yet" via isScopeResolved rather than "signed out", and writes are refused rather than guessing a scope. Login state is cached per scope so one identity's cache can never answer for another. Also adds the debug-only harness the measurement was taken with, under Advanced > Developer > Experiments.
76 lines
2.8 KiB
Swift
76 lines
2.8 KiB
Swift
//
|
|
// CloudKitIdentity.swift
|
|
// Yattee
|
|
//
|
|
// Resolves the Apple account identity that account-scoped local state is
|
|
// namespaced by (Keychain items, the account cache, the sync outbox).
|
|
//
|
|
|
|
import CloudKit
|
|
import CryptoKit
|
|
import Foundation
|
|
|
|
/// The identity that account-scoped local state is keyed by.
|
|
///
|
|
/// Two different values serve two different purposes:
|
|
///
|
|
/// - `ubiquityFingerprint` is derived from `FileManager.ubiquityIdentityToken`:
|
|
/// synchronous and offline-capable, so launch-time gating can decide whether
|
|
/// the persisted namespace still belongs to the signed-in account *before*
|
|
/// any CloudKit request could complete.
|
|
/// - `userRecordID()` is the CloudKit user record name — the durable scope
|
|
/// value persisted state is namespaced by. It requires the network, so it is
|
|
/// resolved once the account is reachable.
|
|
enum CloudKitIdentity {
|
|
/// Scope used when no Apple account is available (signed out, or a
|
|
/// sideloaded build with no iCloud entitlement).
|
|
static let localScope = "local"
|
|
|
|
/// Short, stable fingerprint of the currently signed-in Apple account.
|
|
///
|
|
/// `nil` when no Apple account is signed in. The value is opaque and
|
|
/// carries no account information — it only supports equality comparison
|
|
/// against a previously persisted fingerprint.
|
|
static var ubiquityFingerprint: String? {
|
|
guard let token = FileManager.default.ubiquityIdentityToken,
|
|
let data = try? NSKeyedArchiver.archivedData(
|
|
withRootObject: token,
|
|
requiringSecureCoding: true
|
|
)
|
|
else { return nil }
|
|
|
|
return shortDigest(of: data)
|
|
}
|
|
|
|
/// The CloudKit user record name for the current identity.
|
|
///
|
|
/// Returns `nil` when CloudKit is unavailable (sideloaded build), when no
|
|
/// Apple account is signed in, or when the container cannot be reached —
|
|
/// callers must fall back to ``localScope`` rather than treating `nil` as
|
|
/// an error state.
|
|
static func userRecordID() async -> String? {
|
|
guard CloudKitAvailability.isAvailable else { return nil }
|
|
|
|
do {
|
|
let container = CKContainer(identifier: AppIdentifiers.iCloudContainer)
|
|
return try await container.userRecordID().recordName
|
|
} catch {
|
|
LoggingService.shared.debug(
|
|
"Could not resolve CloudKit user record ID",
|
|
category: .cloudKit,
|
|
details: "\(error)"
|
|
)
|
|
return nil
|
|
}
|
|
}
|
|
|
|
/// First 8 bytes of the SHA-256 digest, hex encoded — short enough to read
|
|
/// in a log line, wide enough that collisions are not a practical concern.
|
|
static func shortDigest(of data: Data) -> String {
|
|
SHA256.hash(data: data)
|
|
.prefix(8)
|
|
.map { String(format: "%02x", $0) }
|
|
.joined()
|
|
}
|
|
}
|