feat: re-establish EAR support - WPB-23473 by David-Henner · Pull Request #4299 · wireapp/wire-ios

David-Henner · 2026-02-11T07:25:54Z

WPB-23473 [iOS] Refactor database key access for message encryption & migrations

Issue

This PR re-establishes Encryption at Rest after it was broken by the introduction of dynamic background contexts. The implementation decouples encryption logic from NSManagedObjectContext and centralizes database key management through a service-based architecture.

The previous EAR implementation had critical issues:

Missing keys in dynamic contexts - Ad-hoc background contexts created via CoreDataStack.newBackgroundContext() lacked the database key, causing decryption errors and disappearing messages
Migration failures - EAR enable/disable operations create temporary contexts that were missing the database key, causing migration failure
Initialization deadlock - Setting the database key on the contexts was causing a deadlock on the view context.

Changes

Created EARMessageEncryptionService for database key management and centralized encryption
Created EARMigrator for migrations when enabling / disabling EAR
Made EARService initialization async
Split unit tests from integration tests with EARServiceTests and EARServiceIntegrationTests
Added doc comments

Checklist

Title contains a reference JIRA issue number like [WPB-XXX].
Description is filled and free of optional paragraphs.
Adds/updates automated tests.

# Conflicts: # WireDomain/Sources/WireDomain/Helpers/ProtobufMessageDecoder.swift

github-actions · 2026-02-13T10:26:49Z

Test Results

8 files 982 suites 9m 50s ⏱️
7 059 tests 7 031 ✅ 28 💤 0 ❌
7 060 runs 7 032 ✅ 28 💤 0 ❌

Results for commit 18f63c3.

♻️ This comment has been updated with latest results.

Summary: workflow run #22218036080
Allure report (download zip): html-report-28036-feat_ear-support-without-new-sync

datadog-wireapp · 2026-02-13T10:42:00Z

⚠️ Tests

✨ Fix all issues with Cursor

⚠️ Warnings

🧪 14 Tests failed

testThatDatabaseIsLocked_AfterBackgroundTaskCompletesInTheBackground() from UnitTests.ZMUserSessionTests_EncryptionAtRest (Datadog) (Fix with Cursor)
Crash: WireSyncEngine Test Host at ZMUserSessionTests_EncryptionAtRest.setEncryptionAtRest(enabled:file:line:)
testThatDatabaseIsLocked_AfterEnteringBackground() from UnitTests.ZMUserSessionTests_EncryptionAtRest (Datadog) (Fix with Cursor)
Crash: WireSyncEngine Test Host at ZMUserSessionTests_EncryptionAtRest.setEncryptionAtRest(enabled:file:line:)
testThatDatabaseIsLocked_WhenTheCustomTimeoutHasExpiredInTheBackground() from UnitTests.ZMUserSessionTests_EncryptionAtRest (Datadog) (Fix with Cursor)
Crash: WireSyncEngine Test Host at implicit closure #1 in ZMUserSessionTests_EncryptionAtRest.testThatDatabaseIsLocked_WhenTheCustomTimeoutHasExpiredInTheBackground()
View all

ℹ️ Info

❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 27f2676 | Docs | Was this helpful? Give us feedback!}

David-Henner · 2026-02-13T10:16:48Z

wire-ios-data-model/Tests/Authentication/EAR/EARServiceTests.swift

-    // @SF.Storage @TSFI.FS-IOS @TSFI.Enclave-IOS @S0.1 @S0.2
-    // Make sure that message content is encrypted when EAR is enabled
-    func test_ExistingMessageContentIsEncrypted_WhenEarIsEnabled() throws {
-        // Given
-        uiMOC.encryptMessagesAtRest = false
-        uiMOC.databaseKey = nil
-
-        let conversation = createConversation(in: uiMOC)
-        try conversation.appendText(content: "Beep bloop")
-
-        let results: [ZMGenericMessageData] = try uiMOC.fetchObjects()
-
-        guard let messageData = results.first else {
-            XCTFail("Could not find message data.")
-            return
-        }
-
-        // Then
-        XCTAssertFalse(messageData.isEncrypted)
-        XCTAssertEqual(messageData.unencryptedContent, "Beep bloop")
-        XCTAssertFalse(uiMOC.encryptMessagesAtRest)
-
-        // Mock
-        mockKeyGeneration()
-
-        // When
-        XCTAssertNoThrow(try sut.enableEncryptionAtRest(context: uiMOC))
-
-        // Then migration was run
-        XCTAssertEqual(prepareForMigrationCalls, 1)
-        XCTAssertTrue(messageData.isEncrypted)
-        XCTAssertEqual(messageData.unencryptedContent, "Beep bloop")
-
-        // Then EAR is enabled on the context
-        XCTAssertTrue(uiMOC.encryptMessagesAtRest)
-    }
-
-    // @SF.Storage @TSFI.FS-IOS @TSFI.Enclave-IOS @S0.1 @S0.2
-    // Make sure that message content normalized for text search is also encrypted when EAR is enabled
-    func test_NormalizedMessageContentIsCleared_WhenEarIsEnabled() throws {
-        // Given
-        uiMOC.encryptMessagesAtRest = false
-        uiMOC.databaseKey = nil
-
-        let conversation = createConversation(in: uiMOC)
-        let message = try conversation.appendText(content: "Beep bloop") as! ZMMessage
-
-        // Then
-        XCTAssertNotNil(message.normalizedText)
-        XCTAssertEqual(message.normalizedText?.isEmpty, false)
-
-        // Mock
-        mockKeyGeneration()
-
-        // When
-        XCTAssertNoThrow(try sut.enableEncryptionAtRest(context: uiMOC))
-
-        // Then
-        XCTAssertNotNil(message.normalizedText)
-        XCTAssertEqual(message.normalizedText?.isEmpty, true)
-        XCTAssertTrue(uiMOC.encryptMessagesAtRest)
-    }
-
-    // @SF.Storage @TSFI.FS-IOS @TSFI.Enclave-IOS @S0.1 @S0.2
-    // Make sure that message content that is drafted but not send by the user yet is also encrypted
-    // when EAR is enabled
-    func test_DraftMessageContentIsEncrypted_WhenEarIsEnabled() throws {
-        // Given
-        uiMOC.encryptMessagesAtRest = false
-        uiMOC.databaseKey = nil
-
-        let conversation = createConversation(in: uiMOC)
-        conversation.draftMessage = DraftMessage(
-            text: "Beep bloop",
-            mentions: [],
-            quote: nil
-        )
-
-        // Then
-        XCTAssertTrue(conversation.hasDraftMessage)
-        XCTAssertFalse(conversation.hasEncryptedDraftMessageData)
-        XCTAssertEqual(conversation.unencryptedDraftMessageContent, "Beep bloop")
-
-        // Mock
-        mockKeyGeneration()
-
-        // When
-        XCTAssertNoThrow(try sut.enableEncryptionAtRest(context: uiMOC))
-
-        // Then
-        XCTAssertTrue(conversation.hasEncryptedDraftMessageData)
-        XCTAssertEqual(conversation.unencryptedDraftMessageContent, "Beep bloop")
-        XCTAssertTrue(uiMOC.encryptMessagesAtRest)
-    }


Moved these security tests to EARServiceIntegrationTests

David-Henner · 2026-02-13T10:17:24Z

wire-ios-data-model/Tests/Authentication/EAR/EARServiceTests.swift


    // MARK: - Security tests

-    // @SF.Storage @TSFI.FS-IOS @TSFI.Enclave-IOS @S0.1 @S0.2


moved to EARServiceIntegrationTests

David-Henner · 2026-02-13T10:17:37Z

wire-ios-data-model/Tests/Authentication/EAR/EARServiceTests.swift

        XCTAssertEqual(keyRepository.deleteDatabaseKeyDescription_Invocations.count, 1)
    }

-    // @SF.Storage @TSFI.UserInterface @S0.1 @S0.2


moved to EARServiceIntegrationTests

David-Henner · 2026-02-13T11:08:35Z

wire-ios-sync-engine/Tests/Source/UserSession/ZMUserSessionTests+EncryptionAtRest.swift

 import WireDataModelSupport
 @testable import WireSyncEngine

+// TODO: [WPB-23474] Fix the tests setup


This test class is skipped temporarily

netbe

left a couple questions before approving

wire-ios-data-model/Source/Authentication/EAR/EARMessageEncryptionService.swift

netbe · 2026-02-13T13:14:37Z

wire-ios-data-model/Source/Authentication/EAR/EARMessageEncryptionService.swift

+            lock.unlock()
+            return cached
+        }
+
+        defer {
+            lock.unlock()
+        }


question: can't we just do defer { lock.unlock() from the top?

wire-ios-data-model/Source/Authentication/EAR/EARService.swift

netbe · 2026-02-13T13:36:51Z

wire-ios-data-model/Source/ManagedObjectContext/CoreDataStack.swift

        #endif
+
+        // Set the EARMessageEncryptionService on the new background context
+        context.performAndWait {


suggestion: what about making the method async

My intuition is that since this context has just been created and not returned, in no place else could there be a simultaneous performAndWait which could lead to a deadlock.

netbe · 2026-02-13T13:42:33Z

wire-ios-data-model/Tests/Authentication/EAR/EARServiceIntegrationTests.swift

+    // MARK: - Security Tests
+
+    // @SF.Storage @TSFI.FS-IOS @TSFI.Enclave-IOS @S0.1 @S0.2
+    func test_ItStoresAndClearsDatabaseKeyOnAllContexts() async throws {


todo: check the security tests is enabled the Security Tests plan

done cbbf667

netbe · 2026-02-13T13:50:38Z

wire-ios-data-model/Tests/Authentication/EAR/EARServiceIntegrationTests.swift

+            keyRepository: EARKeyRepository(),  // Real keychain access
+            keyEncryptor: EARKeyEncryptor(),    // Real crypto


question: why do we need real objects here?

They're used to generate and store real keys. The test is verifying that the service is replacing keys after disabling / enabling EAR.

johnxnguyen

Looks good! I'll approve when the current conversations are resolved. Also, are we able to playtest these changes as is or is there something missing?

wire-ios-data-model/Source/Authentication/EAR/EARMessageEncryptionService.swift

johnxnguyen · 2026-02-16T12:42:02Z

wire-ios-data-model/Source/Authentication/EAR/EARMigrator.swift

+
+            let contextData = try context.earContextData()
+
+            context.saveOrRollback()


suggestion: a comment explaining this save would be nice.

TBH I'm not sure why it's there. I've moved this part of the code from the NSManagedObjecContext extension.

johnxnguyen · 2026-02-16T12:46:08Z

wire-ios-data-model/Source/ManagedObjectContext/CoreDataStack.swift

        #endif
+
+        // Set the EARMessageEncryptionService on the new background context
+        context.performAndWait {


My intuition is that since this context has just been created and not returned, in no place else could there be a simultaneous performAndWait which could lead to a deadlock.

David-Henner · 2026-02-16T13:06:50Z

Looks good! I'll approve when the current conversations are resolved. Also, are we able to playtest these changes as is or is there something missing?

@johnxnguyen besides incremental sync support coming in a separate PR, there's nothing missing and it can be playtested

wire-ios-sync-engine/Source/SessionManager/SessionManager+EncryptionAtRest.swift

emil-wire · 2026-02-16T14:26:22Z

wire-ios-data-model/Source/Model/Message/ZMGenericMessageData.swift

        do {
-            return try moc.encryptData(data: data)
-        } catch let error as NSManagedObjectContext.EncryptionError {
+            let service = try moc.getEarMessageEncryptionService()


getEarMessageEncryptionService() will throw if this context wasn’t wired with the EAR service. Any ad‑hoc context that skips setEARMessageEncryptionService will now fail encryption at runtime when EAR is enabled - can we enforce injection or assert here?

added an assertion cbbf667

emil-wire · 2026-02-16T14:27:28Z

wire-ios-data-model/Source/Public/DraftMessage.swift

        guard moc.encryptMessagesAtRest else { return (data, nonce: nil) }
-        return try moc.encryptData(data: data)
+
+        let service = try moc.getEarMessageEncryptionService()


Same as above: this assumes earMessageEncryptionService is injected into the context. If any context is created outside CoreDataStack (or before injection), draft encryption will throw - can we assert/guard or centralize context creation to guarantee injection?

same as above, I added an assertion. Additionally, the context creation is centralized through CoreDataStack. Although there's nothing restricting from creating a context differently

wire-ios-data-model/Source/Authentication/EAR/EARMessageEncryptionService.swift

wire-ios-data-model/Source/ManagedObjectContext/NSManagedObjectContext+EncryptionAtRest.swift

wire-ios-data-model/Source/Authentication/EAR/EARMessageEncryptionService.swift

wire-ios-sync-engine/Source/SessionManager/SessionManager+Backup.swift

sonarqubecloud · 2026-02-20T09:13:53Z

Quality Gate passed

Issues
69 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

netbe

Looks good to me

netbe · 2026-02-20T14:42:08Z

wire-ios-sync-engine/Tests/TestsPlans/AllTests.xctestplan

      "skippedTests" : [
        "AvailabilityTests",
        "EventProcessingPerformanceTests",
+        "SessionManagerEncryptionAtRestMigrationTests",


question: why is it skipped ?

disabled tests will be re-enabled in another PR I guess

github-actions bot assigned David-Henner Feb 11, 2026

github-actions bot added the Fix PR Title 🤦‍♂️ label Feb 11, 2026

David-Henner added 12 commits February 13, 2026 10:18

initial commit

0d17ed3

# Conflicts: # WireDomain/Sources/WireDomain/Helpers/ProtobufMessageDecoder.swift

avoid passing the key around for migration

0caf0f1

use migrator for the backup

d926218

cleanup

4ded3b8

sourcery

4e7df0a

async EARService init

52371cb

update tests - WIP

8ee725f

update locking mechanism

77702c0

fix migration order

4414ef8

update tests

cd639fb

cleanup

0b06e03

disable broken tests

268f4a8

David-Henner force-pushed the feat/ear-support-without-new-sync branch from feb4b98 to 268f4a8 Compare February 13, 2026 09:21

David-Henner changed the base branch from develop to feat/ear-support February 13, 2026 09:28

David-Henner changed the title ~~feat: re-establish EAR support~~ feat: re-establish EAR support - WPB-23473 Feb 13, 2026

github-actions bot removed the Fix PR Title 🤦‍♂️ label Feb 13, 2026

David-Henner added 2 commits February 13, 2026 10:40

documentation

fdc1a3f

format

0e21467

David-Henner marked this pull request as ready for review February 13, 2026 10:00

amend comments

3ff662d

David-Henner requested review from emil-wire, johnxnguyen, netbe and sanojwr February 13, 2026 10:14

David-Henner commented Feb 13, 2026

View reviewed changes

netbe reviewed Feb 13, 2026

View reviewed changes

johnxnguyen reviewed Feb 16, 2026

View reviewed changes

emil-wire reviewed Feb 16, 2026

View reviewed changes

code review

cbbf667

David-Henner requested review from emil-wire, johnxnguyen and netbe February 18, 2026 16:17

David-Henner added 4 commits February 18, 2026 17:25

format

afac04f

update tests

a1a5ef4

cleanup

60a17ea

set mocks

e8f538c

David-Henner changed the base branch from feat/ear-support to release/cycle-4.16 February 19, 2026 08:54

David-Henner added 7 commits February 19, 2026 09:55

Merge branch 'release/cycle-4.16' into feat/ear-support-without-new-sync

48b79c6

fix user session tests

dae5053

disable some ear tests temporarily

63c6996

remove unnecessary await

3be3f7a

format

27f2676

disable ear tests instead of user session tests

3ed2fca

fix sharing session tests

18f63c3

netbe added the release label Feb 20, 2026

netbe approved these changes Feb 20, 2026

View reviewed changes


		// MARK: - Security tests

		// @SF.Storage @TSFI.FS-IOS @TSFI.Enclave-IOS @S0.1 @S0.2

		keyRepository: EARKeyRepository(), // Real keychain access
		keyEncryptor: EARKeyEncryptor(), // Real crypto


		let contextData = try context.earContextData()

		context.saveOrRollback()

Comments

Conversation

David-Henner commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue

Changes

Checklist

Uh oh!

github-actions bot commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

Uh oh!

datadog-wireapp bot commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Warnings

ℹ️ Info

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

netbe left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

johnxnguyen left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

David-Henner commented Feb 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud bot commented Feb 20, 2026

Quality Gate passed

Uh oh!

David-Henner commented Feb 11, 2026 •

edited

Loading

github-actions bot commented Feb 13, 2026 •

edited

Loading

datadog-wireapp bot commented Feb 13, 2026 •

edited

Loading

David-Henner commented Feb 16, 2026 •

edited

Loading