KeychainClient

[saroar]

I have create KeychainClient work with DependencyKey but having some issue and like to get some feed back and if need to improve it

import Foundation
import XCTestDynamicOverlay

public enum ServiceKeys: NSString {
  case token, deviceToken, voipToken, user, mobileNumbers, serverContacts, deviceinfo,
    cllocation2d
}

protocol KeychainProtocol {
    @Sendable func save(_ data: Data, _ service: ServiceKeys, _ account: String) async throws
    @Sendable func update(password: Data, service: ServiceKeys, account: String) async throws
    @Sendable func read(_ service: ServiceKeys, _ account: String) throws -> Data
    @Sendable func deletePassword(service: ServiceKeys, account: String) async throws
    @Sendable func readCodable<T: Codable>(_ service: ServiceKeys, _ account: String, _ type: T.Type) throws -> T
}

struct KeychainClient: KeychainProtocol {

    enum KeychainError: Error {
        // Attempted read for an item that does not exist.
        case itemNotFound

        // Attempted save to override an existing item.
        // Use update instead of save to update existing items
        case duplicateItem

        // A read of an item in any format other than Data
        case invalidItemFormat

        // Any operation result status than errSecSuccess
        case unexpectedStatus(OSStatus)

        case errorStatus(String?)

        init(status: OSStatus) {
            switch status {
            case errSecItemNotFound:
                self = .itemNotFound
            case errSecDuplicateItem:
                self = .duplicateItem
            default:
                let message = SecCopyErrorMessageString(status, nil) as String?
                self = .errorStatus(message)
            }
        }
    }

    @Sendable func save(_ data: Data, _ service: ServiceKeys, _ account: String) async throws {

        let query: [String: AnyObject] = [
            // kSecAttrService,  kSecAttrAccount, and kSecClass
            // uniquely identify the item to save in Keychain
            kSecAttrService as String: service.rawValue as AnyObject,
            kSecAttrAccount as String: account as AnyObject,
            kSecClass as String: kSecClassGenericPassword,

            // kSecValueData is the item value to save
            kSecValueData as String: data as AnyObject
        ]

        // SecItemAdd attempts to add the item identified by
        // the query to keychain
        let status = SecItemAdd(
            query as CFDictionary,
            nil
        )

        // errSecDuplicateItem is a special case where the
        // item identified by the query already exists. Throw
        // duplicateItem so the client can determine whether
        // or not to handle this as an error
        if status == errSecDuplicateItem {
            throw KeychainError.init(status: status)
        }

        // Any status other than errSecSuccess indicates the
        // save operation failed.
        guard status == errSecSuccess else {
            throw KeychainError.unexpectedStatus(status)
        }
    }

    @Sendable func update(password: Data, service: ServiceKeys, account: String) async throws {
        let query: [String: AnyObject] = [
            // kSecAttrService,  kSecAttrAccount, and kSecClass
            // uniquely identify the item to update in Keychain
            kSecAttrService as String: service.rawValue as AnyObject,
            kSecAttrAccount as String: account as AnyObject,
            kSecClass as String: kSecClassGenericPassword
        ]

        // attributes is passed to SecItemUpdate with
        // kSecValueData as the updated item value
        let attributes: [String: AnyObject] = [
            kSecValueData as String: password as AnyObject
        ]

        // SecItemUpdate attempts to update the item identified
        // by query, overriding the previous value
        let status = SecItemUpdate(
            query as CFDictionary,
            attributes as CFDictionary
        )

        // errSecItemNotFound is a special status indicating the
        // item to update does not exist. Throw itemNotFound so
        // the client can determine whether or not to handle
        // this as an error
        guard status != errSecItemNotFound else {
            throw KeychainError(status: status)
        }

        // Any status other than errSecSuccess indicates the
        // update operation failed.
        guard status == errSecSuccess else {
            //throw KeychainError(status: errSecSuccess)
            throw KeychainError.unexpectedStatus(status)
        }
    }

    @Sendable func read(_ service: ServiceKeys, _ account: String) throws -> Data {
        let query: [String: AnyObject] = [
            // kSecAttrService,  kSecAttrAccount, and kSecClass
            // uniquely identify the item to read in Keychain
            kSecAttrService as String: service.rawValue as AnyObject,
            kSecAttrAccount as String: account as AnyObject,
            kSecClass as String: kSecClassGenericPassword,

            // kSecMatchLimitOne indicates keychain should read
            // only the most recent item matching this query
            kSecMatchLimit as String: kSecMatchLimitOne,

            // kSecReturnData is set to kCFBooleanTrue in order
            // to retrieve the data for the item
            kSecReturnData as String: kCFBooleanTrue
        ]

        // SecItemCopyMatching will attempt to copy the item
        // identified by query to the reference itemCopy
        var itemCopy: AnyObject?
        let status = SecItemCopyMatching(
            query as CFDictionary,
            &itemCopy
        )

        // errSecItemNotFound is a special status indicating the
        // read item does not exist. Throw itemNotFound so the
        // client can determine whether or not to handle
        // this case
        guard status != errSecItemNotFound else {
            throw KeychainError.init(status: status)
        }

        // Any status other than errSecSuccess indicates the
        // read operation failed.
        guard status == errSecSuccess else {
            throw KeychainError.unexpectedStatus(status)
        }

        // This implementation of KeychainInterface requires all
        // items to be saved and read as Data. Otherwise,
        // invalidItemFormat is thrown
        guard let password = itemCopy as? Data else {
            throw KeychainError.invalidItemFormat
        }

        return password
    }

    @Sendable func deletePassword(service: ServiceKeys, account: String) async throws {
        let query: [String: AnyObject] = [
            // kSecAttrService,  kSecAttrAccount, and kSecClass
            // uniquely identify the item to delete in Keychain
            kSecAttrService as String: service.rawValue as AnyObject,
            kSecAttrAccount as String: account as AnyObject,
            kSecClass as String: kSecClassGenericPassword
        ]

        // SecItemDelete attempts to perform a delete operation
        // for the item identified by query. The status indicates
        // if the operation succeeded or failed.
        let status = SecItemDelete(query as CFDictionary)

        // Any status other than errSecSuccess indicates the
        // delete operation failed.
        guard status == errSecSuccess else {
            throw KeychainError.unexpectedStatus(status)
        }
    }

    @Sendable func saveCodable<T: Codable>(_ item: T, _ service: ServiceKeys, _ account: String) async throws -> Void {
        do {
            // Encode as JSON data and save in keychain
            let data = try JSONEncoder().encode(item)
            try await save(data, service, account)

        } catch {
            print(#line, error.localizedDescription)
            throw KeychainError.duplicateItem
        }
    }

    @Sendable func readCodable<T: Codable>(_ service: ServiceKeys, _ account: String, _ type: T.Type) throws -> T {
        do {
            // Read item data from keychain
            let data = try read(service, account)

            // Decode JSON data to object
            let item = try JSONDecoder().decode(type, from: data)
            return item
        } catch {
            throw KeychainError.itemNotFound
        }
    }
}

struct KeychainClientMock: KeychainProtocol {
    func save(_ data: Data, _ service: ServiceKeys, _ account: String) async throws {
//        XCTUnimplemented("\(Self.self).save", placeholder: nil)
//        XCTUnimplemented("")
    }

    func update(password: Data, service: ServiceKeys, account: String) async throws {
//        XCTUnimplemented("")
    }

    func read(_ service: ServiceKeys, _ account: String) throws -> Data {
//        XCTUnimplemented("\(Self).read", placeholder: Data())
        return Data()
    }

    func deletePassword(service: ServiceKeys, account: String) async throws {
//        XCTUnimplemented("")
    }

    func readCodable<T: Codable>(_ service: ServiceKeys, _ account: String, _ type: T.Type) throws -> T {
//        XCTUnimplemented("")

        do {
            // Read item data from keychain
            let data = try read(service, account)

            // Decode JSON data to object
            let item = try JSONDecoder().decode(type, from: data)
            return item
        } catch {
            throw KeychainError()
        }
    }

    struct KeychainError: Error {}
    struct Nothing: Codable {}
}

import Dependencies

// Type 'KeychainClientKey' does not conform to protocol 'DependencyKey'
private enum KeychainClientKey: DependencyKey { 
    static let liveValue = KeychainClient()
    static let testValue = KeychainClientMock()
}

extension DependencyValues {
    var keychainClient: KeychainClient {
        get { self[KeychainClientKey.self] }
        set { self[KeychainClientKey.self] = newValue }
    }
}

[tgrapperon]

Hey @saroar! testValue should return the same type as liveValue, and in your case, KeychainClientMock is not a KeychainClient. It could probably work using any KeychainProtocol instead. Another convenient approach would be to remove the KeychainProtocol and use this kind of construct:

struct KeychainClient {
  var save: @Sendable (_ data: Data, _ service: ServiceKeys, _ account: String) async throws
  var update: @Sendable (_ password: Data, _ service: ServiceKeys, _ account: String) async throws
  var read: @Sendable (_ service: ServiceKeys, _ account: String) throws -> Data
  var deletePassword: @Sendable (_ service: ServiceKeys, _ account: String) async throws
  
  func readCodable<T: Codable>(_ service: ServiceKeys, _ account: String, _ type: T.Type) throws -> T {
    do {
      let data = try read(service, account)
      let item = try JSONDecoder().decode(type, from: data)
      return item
    } catch {
      throw KeychainError.itemNotFound
    }
  }
}

And you then create types of this value:

static let liveValue = KeychainClient(
  save: { … },
  update: { … },
  read: { … },
  deletePassword: { … }
)

and the same for testValue, using unimplemented in place of these closures. You can find a similar example with SpeechClient in the SpeechRecognition example.

The generic function would be tricky to model using closures, but I don't think this is something that is parametric here, once you have a way to serialize to data, so you can define it directly once and for all in the KeychainClient type or in an extension of it.

[saroar]

only issue I am getting this
The operation couldn’t be completed. (We.KeychainClient.KeychainError error 3.)
from
func @Sendable public func saveCodable<T: Codable>(_ item: T, _ service: ServiceKeys, _ account: String) async throws -> Void

[saroar]

also do you think we make better this code
as I see account parameters use some place which should be use only one time no?

[tgrapperon]

The account can be another dependency that you access from your reducer to make your calls. Given the level of complexity you're already facing, I wouldn't probably recommend to bake it into KeyChainClient. This is maybe something you can do only once your setup is under control.
I don't really now why you're getting an error in your case, but it seems unrelated to TCA or dependencies. You're probably extracting the wrong kind of data, or trying to decode the wrong type of value. Maybe you can put breakpoints to check where the error is thrown.

[saroar]

account is my app bundle identifier
about error happening but I am getting result what I need but its strange

[saroar]

@tgrapperon thanks for help 🙏🏾