Security and Privacy

// Packages/FieldNotesKit/Sources/FieldNotesServices/Security/KeychainStore.swift
import Foundation
import Security

public struct KeychainStore: Sendable {
    public enum KeychainError: Error, Equatable {
        case unexpectedStatus(OSStatus)
        case unexpectedData
    }

    public let service: String
    public let accessGroup: String?

    public init(service: String = "com.example.fieldnotes.auth",
                accessGroup: String? = "group.com.example.fieldnotes") {
        self.service = service
        self.accessGroup = accessGroup
    }

    /// The attributes that identify one item: class, service, account and group.
    private func baseQuery(account: String) -> [String: Any] {
        var query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: account,
            kSecUseDataProtectionKeychain as String: true,   // iOS-style keychain on macOS too
        ]
        if let accessGroup { query[kSecAttrAccessGroup as String] = accessGroup }
        return query
    }

    /// Adds the item, or updates it if it already exists.
    public func set(_ data: Data, for account: String,
                    accessible: CFString = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly) throws {
        var attributes = baseQuery(account: account)
        attributes[kSecValueData as String] = data
        attributes[kSecAttrAccessible as String] = accessible

        let status = SecItemAdd(attributes as CFDictionary, nil)
        switch status {
        case errSecSuccess:
            return
        case errSecDuplicateItem:
            try update(data, for: account)
        default:
            throw KeychainError.unexpectedStatus(status)
        }
    }

    public func data(for account: String) throws -> Data? {
        var query = baseQuery(account: account)
        query[kSecReturnData as String] = true
        query[kSecMatchLimit as String] = kSecMatchLimitOne

        var result: CFTypeRef?
        let status = SecItemCopyMatching(query as CFDictionary, &result)
        switch status {
        case errSecSuccess:
            guard let data = result as? Data else { throw KeychainError.unexpectedData }
            return data
        case errSecItemNotFound:
            return nil
        default:
            throw KeychainError.unexpectedStatus(status)
        }
    }

    public func update(_ data: Data, for account: String) throws {
        let changes: [String: Any] = [kSecValueData as String: data]
        let status = SecItemUpdate(baseQuery(account: account) as CFDictionary, changes as CFDictionary)
        guard status == errSecSuccess else { throw KeychainError.unexpectedStatus(status) }
    }

    public func delete(account: String) throws {
        let status = SecItemDelete(baseQuery(account: account) as CFDictionary)
        guard status == errSecSuccess || status == errSecItemNotFound else {
            throw KeychainError.unexpectedStatus(status)
        }
    }
}

// Packages/FieldNotesKit/Sources/FieldNotesServices/Security/BiometricLock.swift
import LocalAuthentication
import Observation

@Observable @MainActor
public final class BiometricLock {
    public private(set) var isLocked = true
    public private(set) var sensorName = "Passcode"

    public init() {
        let context = LAContext()
        var error: NSError?
        #if !os(watchOS)
        if context.canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: &error) {
            switch context.biometryType {
            case .faceID:  sensorName = "Face ID"
            case .touchID: sensorName = "Touch ID"
            case .opticID: sensorName = "Optic ID"
            default:       break
            }
        }
        #endif
    }

    /// Asks for biometrics, falling back to the device passcode.
    public func unlock() async {
        let context = LAContext()
        context.localizedCancelTitle = "Keep Locked"
        do {
            isLocked = !(try await context.evaluatePolicy(
                .deviceOwnerAuthentication,
                localizedReason: "Unlock your private notes"))
        } catch {
            isLocked = true   // LAError.userCancel, .biometryLockout, ...
        }
    }

    public func lock() { isLocked = true }
}

// FieldNotes/Views/ContentView.swift (excerpt)
@Environment(BiometricLock.self) private var biometricLock
@Environment(\.scenePhase) private var scenePhase

var body: some View {
    NavigationSplitView { /* sidebar, NoteList(notebookID:selection:), NoteDetail(note:) */ }
        .overlay {
            if biometricLock.isLocked {
                ContentUnavailableView {
                    Label("Notes Locked", systemImage: "lock.fill")
                } actions: {
                    Button("Unlock with \(biometricLock.sensorName)") {
                        Task { await biometricLock.unlock() }
                    }
                }
                .background(.background)
            }
        }
        .onChange(of: scenePhase) { _, phase in
            if phase == .background { biometricLock.lock() }
        }
}

// Packages/FieldNotesKit/Sources/FieldNotesServices/Security/AccountManager.swift
import AuthenticationServices
import Foundation
import Observation

/// What AccountManager needs from the FieldNotes server. All values are opaque to the app.
public protocol AccountServerAPI: Sendable {
    func signInWithApple(identityToken: Data, rawNonce: String) async throws -> String       // session token
    func passkeyRegistrationChallenge(userName: String) async throws -> (challenge: Data, userID: Data)
    func finishPasskeyRegistration(credentialID: Data, attestationObject: Data?,
                                   clientDataJSON: Data) async throws -> String
    func passkeyAssertionChallenge() async throws -> Data
    func finishPasskeyAssertion(credentialID: Data, authenticatorData: Data, signature: Data,
                                userID: Data, clientDataJSON: Data) async throws -> String
}

@Observable @MainActor
public final class AccountManager {
    public enum State: Equatable { case signedOut, signedIn }

    public static let relyingParty = "fieldnotes.example.com"
    public private(set) var state: State = .signedOut

    // internal, not private: the Sign in with Apple and passkey extensions live in other files
    @ObservationIgnored let keychain: KeychainStore
    @ObservationIgnored let server: any AccountServerAPI
    @ObservationIgnored var pendingNonce: String?

    public init(server: any AccountServerAPI, keychain: KeychainStore = KeychainStore()) {
        self.server = server
        self.keychain = keychain
        if (try? keychain.data(for: "session")) != nil { state = .signedIn }
    }

    func storeSession(_ token: String) throws {
        try keychain.set(Data(token.utf8), for: "session")
        state = .signedIn
    }

    public func signOut() throws {
        try keychain.delete(account: "session")
        state = .signedOut
    }
}

<?xml version="1.0" encoding="UTF-8"?>
<!-- FieldNotes/FieldNotes-macOS.entitlements -->
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.network.client</key>                 <!-- sync with the API -->
    <true/>
    <key>com.apple.security.files.user-selected.read-write</key> <!-- notebook import and export -->
    <true/>
    <key>com.apple.security.personal-information.location</key>   <!-- location tagging -->
    <true/>
    <key>com.apple.security.application-groups</key>
    <array>
        <string>group.com.example.fieldnotes</string>
    </array>
    <key>com.apple.developer.applesignin</key>
    <array>
        <string>Default</string>
    </array>
    <key>com.apple.developer.associated-domains</key>
    <array>
        <string>webcredentials:fieldnotes.example.com</string>
        <string>applinks:fieldnotes.example.com</string>
    </array>
</dict>
</plist>

<?xml version="1.0" encoding="UTF-8"?>
<!-- FieldNotes/PrivacyInfo.xcprivacy -->
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>NSPrivacyTracking</key>
    <false/>
    <key>NSPrivacyTrackingDomains</key>
    <array/>
    <key>NSPrivacyCollectedDataTypes</key>
    <array>
        <dict>
            <key>NSPrivacyCollectedDataType</key>
            <string>NSPrivacyCollectedDataTypePreciseLocation</string>
            <key>NSPrivacyCollectedDataTypeLinked</key>
            <true/>
            <key>NSPrivacyCollectedDataTypeTracking</key>
            <false/>
            <key>NSPrivacyCollectedDataTypePurposes</key>
            <array>
                <string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string>
            </array>
        </dict>
    </array>
    <key>NSPrivacyAccessedAPITypes</key>
    <array>
        <dict>
            <key>NSPrivacyAccessedAPIType</key>
            <string>NSPrivacyAccessedAPICategoryUserDefaults</string>
            <key>NSPrivacyAccessedAPITypeReasons</key>
            <array>
                <string>CA92.1</string>   <!-- defaults only this app reads and writes -->
                <string>1C8F.1</string>   <!-- defaults shared within the App Group -->
            </array>
        </dict>
        <dict>
            <key>NSPrivacyAccessedAPIType</key>
            <string>NSPrivacyAccessedAPICategoryFileTimestamp</string>
            <key>NSPrivacyAccessedAPITypeReasons</key>
            <array>
                <string>C617.1</string>   <!-- files inside the app, App Group or CloudKit container -->
            </array>
        </dict>
    </array>
</dict>
</plist>

#if canImport(AppTrackingTransparency)
import AppTrackingTransparency

@MainActor
func requestTrackingIfNeeded() async {
    guard ATTrackingManager.trackingAuthorizationStatus == .notDetermined else { return }
    let status = await ATTrackingManager.requestTrackingAuthorization()
    if status != .authorized {
        // Keep ad SDKs in their non-personalized mode.
    }
}
#endif

// FieldNotesServices/Security/AppIntegrity.swift
#if canImport(DeviceCheck)
import CryptoKit
import DeviceCheck
import Foundation

actor AppIntegrity {
    private let service = DCAppAttestService.shared
    private let keychain = KeychainStore()

    /// Once per install: create and attest a key. Returns nil where App Attest is unavailable.
    func attestIfNeeded(serverChallenge: Data) async throws -> (keyID: String, attestation: Data)? {
        guard service.isSupported, try keychain.data(for: "app-attest-key") == nil else { return nil }
        let keyID = try await service.generateKey()
        let hash = Data(SHA256.hash(data: serverChallenge))
        let attestation = try await service.attestKey(keyID, clientDataHash: hash)
        try keychain.set(Data(keyID.utf8), for: "app-attest-key")
        return (keyID, attestation)       // the server verifies it and stores the public key
    }

    /// For each sensitive request: sign the request body plus a fresh server challenge.
    func assertion(for requestBody: Data, challenge: Data) async throws -> Data? {
        guard let stored = try keychain.data(for: "app-attest-key") else { return nil }
        let keyID = String(decoding: stored, as: UTF8.self)
        let clientDataHash = Data(SHA256.hash(data: requestBody + challenge))
        return try await service.generateAssertion(keyID, clientDataHash: clientDataHash)
    }
}
#endif

// DeviceCheck's two per-device bits: the server stores them via Apple, keyed by this token.
let token = try await DCDevice.current.generateToken()

// FieldNotesServices/Security/AccountChangeGuard.swift
#if canImport(TrustInsights)
import TrustInsights

@available(iOS 27, *)
enum AccountChangeGuard {
    /// true when FieldNotes should add an extra confirmation step.
    static func needsExtraFriction() async -> Bool {
        let context = InsightEvaluator.InsightContext(
            operationCategory: .account,
            requestedEvaluations: IsLikelyBeingCoachedInsight.request(schema: .version1))
        let evaluator = InsightEvaluator()
        do {
            switch try await evaluator.authorizationStatus(for: context) {
            case .authorized:
                break
            case .notDetermined, .deniedRequestable:
                guard try await evaluator.requestAuthorization(for: context) == .authorized else { return false }
            default:
                return false
            }
            let evaluation = try await evaluator.requestEvaluation(context: context)
            switch try evaluation.insight.outcome.get() {
            case .medium, .high:
                evaluation.reportConsumption(.usedIncreasedFriction)
                return true
            default:
                evaluation.reportConsumption(.usedReducedFriction)
                return false
            }
        } catch {
            return false
        }
    }
}
#endif

// At the call site, the deployment minimum is 26:
// if #available(iOS 27, *), await AccountChangeGuard.needsExtraFriction() { showCoolingOffSheet = true }