supabase / supabase-swift / 31826165516

87%

Build Type

push

github

Committed by web-flow

Commit Message

fix(auth)!: fix macOS Keychain consent prompt and storage contract (#1208)

* fix(auth)!: return nil from Keychain reads when the item is absent

A missing item threw .itemNotFound instead of returning nil, contradicting
AuthLocalStorage's documented contract. Every fresh launch with no session
logged an error, and try? at the call sites collapsed genuine Keychain
failures into the same nil as 'no session'. Delete is now idempotent.

* feat(auth): add opt-in data-protection Keychain support

Adds a useDataProtectionKeychain flag threaded through every query, and
stops sending kSecAttrAccessible on macOS unless it is enabled — the
file-based Keychain ignores that attribute, so today it is inert.

* feat(auth): add Keychain location resolution helpers

* fix(auth)!: default Keychain service to the host app bundle identifier

Items were namespaced under a fixed 'supabase.gotrue.swift' service shared by
every app embedding the SDK. The service now defaults to the host app's bundle
identifier, matching KeychainAccess and SimpleKeychain. Existing sessions
migrate on first read.

* docs: add v3 migration entries for Keychain storage changes

* docs: narrow macOS consent-prompt claim to what TN3137 supports

Review found the Keychain migration entry overstated what the prior
research established: it asserted the file-based Keychain prompt still
displays the literal old "supabase.gotrue.swift" string, but the
service-name-drives-dialog-text claim was only ever community-sourced,
not Apple-documented (per the design doc's Non-goals section, which is
also why a kSecAttrLabel change was dropped from this work). Reword to
describe only the documented mechanism instead: the prompt is tied to
the app's designated requirement/ACL, governed by code-signing
identity rather than kSecAttrService, per Apple TN3137.

* fix(auth): make Keychain legacy cleanup and migration failure-safe

remove(key:) previously exited before running the legacy-cleanup loop
whenever the prima... (continued)

Coverage Stats

0 of 91 new or added lines in 2 files covered. (0.0%)

52 existing lines in 4 files now uncovered.

8812 of 10356 relevant lines covered (85.09%)

43.37 hits per line