supabase / supabase-swift / 42003931299

96%

push

github

feat(auth)!: keep the Keychain session on this device and update its accessibility in place (#1726)

* feat(auth)!: keep the Keychain session on this device and update its accessibility in place

KeychainStorage now rewrites kSecAttrAccessible when it updates an existing
item, so a session an earlier version stored with AfterFirstUnlock moves to
AfterFirstUnlockThisDeviceOnly on the first save. The item is updated in
place, never deleted and added again. A SecItem seam lets tests prove it.

The client's default storage is now KeychainStorage(useDataProtectionKeychain:
false): sessions stay on this device, and macOS keeps the file-based Keychain
so unsigned Mac apps and test bundles still work.

KeychainStorage DocC documents the escape hatches, the app-level LAContext
pattern for biometrics, and the app-side first-launch check for signing out
after a reinstall.

BREAKING CHANGE: a backup restored to another device no longer carries the
session. Pass KeychainStorage(accessibility: .afterFirstUnlock,
useDataProtectionKeychain: false) to keep the v2 behavior. See
docs/migrations/v3/Auth.md.

Refs SDK-2078

* docs(auth): set the first-launch flag only after sign-out succeeds

Refs SDK-2078

22 of 26 new or added lines in 2 files covered. (84.62%)

15009 of 15692 relevant lines covered (95.65%)

432857.09 hits per line