mirror of
https://github.com/yattee/yattee.git
synced 2026-10-23 13:12:53 +00:00
c4053d5100
Four issues from an external review of the previous commit. The scope was resolved once at startup, so signing out or switching Apple account while the app kept running left it pinned to the old identity - reads and writes would then reach the previous account's retained credentials, which is the exact leak scoping exists to prevent. CredentialIdentityScope now observes NSUbiquityIdentityDidChange and re-resolves. Legacy deletion authority checked only the instance and the identity, not the account. On an instance with several accounts, deleting any of them satisfied the marker lookup and could retire the legacy item another account had adopted, logging out devices still on the previous release. The marker's accountID is now required to match. A first-time resolution that failed (launched offline, CloudKit unreachable) was never retried, disabling credentials for the rest of the process. resolve() now retries with backoff, and resolveIfNeeded() runs on foreground activation. Adoption re-checked nothing at execution time, so a scoped credential delivered by iCloud Keychain between rendering the offer and tapping it would be overwritten with the older legacy secret. Adoption now re-verifies eligibility and writes with a non-replacing add, leaving a duplicate strictly alone. Adds regression tests for the sibling-account deletion and the adoption race.