1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
|
//
// KeychainTokenStore.swift
// octosentry
//
// Stores the GitHub OAuth token in the app's own Keychain item. Not
// synced to iCloud Keychain by default (spec §6) — deliberate given the
// token's access scope. No keychain-access-groups entitlement needed:
// that's only required to share an item across multiple apps/extensions,
// not for an app reading/writing its own item.
//
import Foundation
import Security
nonisolated enum KeychainTokenStore {
private static let service = "net.cleberg.octosentry.github-token"
private static let account = "github-oauth-token"
static func save(_ token: String) throws {
let query: [String: Any] = [
kSecClass as String: kSecClassGenericPassword,
kSecAttrService as String: service,
kSecAttrAccount as String: account,
]
SecItemDelete(query as CFDictionary)
var attributes = query
attributes[kSecValueData as String] = Data(token.utf8)
attributes[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlock
attributes[kSecAttrSynchronizable as String] = false
let status = SecItemAdd(attributes as CFDictionary, nil)
guard status == errSecSuccess else {
throw KeychainError.unhandled(status)
}
}
static func load() -> String? {
let query: [String: Any] = [
kSecClass as String: kSecClassGenericPassword,
kSecAttrService as String: service,
kSecAttrAccount as String: account,
kSecReturnData as String: true,
kSecMatchLimit as String: kSecMatchLimitOne,
]
var result: AnyObject?
let status = SecItemCopyMatching(query as CFDictionary, &result)
guard status == errSecSuccess, let data = result as? Data else { return nil }
return String(data: data, encoding: .utf8)
}
static func delete() {
let query: [String: Any] = [
kSecClass as String: kSecClassGenericPassword,
kSecAttrService as String: service,
kSecAttrAccount as String: account,
]
SecItemDelete(query as CFDictionary)
}
enum KeychainError: Error, LocalizedError {
case unhandled(OSStatus)
var errorDescription: String? {
switch self {
case .unhandled(let status):
let message = SecCopyErrorMessageString(status, nil) as String? ?? "unknown"
return "Keychain error \(status): \(message)"
}
}
}
}
|
