[PR #2250] [MERGED] [EC-835] Add kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly on Watch Keychain #3459

New Issue

2025-11-26T23:33:04-06:00

GiteaMirror commented

2025-11-26 23:33:04 -06:00

📋 Pull Request Information

Original PR: https://github.com/bitwarden/android/pull/2250
Author: @fedemkr
Created: 12/16/2022
Status: ✅ Merged
Merged: 12/22/2022
Merged by: @vvolkgang

Base: master ← Head: EC-835-add-device-only-accessible-keychain

📝 Commits (6)

76659eb EC-835 Added in the Watch app keychain accessible when passcode set this device only and when the passcode is set to signal the iPhone to trigger a sync on opening the watch app
86ceaac Merge branch 'master' into EC-835-add-device-only-accessible-keychain
17dd761 EC-835 Embed LocalAuthentication framework into the watch app to fix no such module when importing it
504f713 Merge branch 'master' into EC-835-add-device-only-accessible-keychain
b975bb1 EC-835 Changed approach to check if Watch has passcode enabled by using Keychain accessible kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly instead of LAContext
9f2df33 EC-835 Fix weird error saying unassigned local variable on the CI compiler. It seems it doesn't realize of the full condition

📊 Changes

13 files changed (+225 additions, -78 deletions)

View changed files

📝 src/iOS.Core/Services/WatchDeviceService.cs (+17 -0)
📝 src/iOS.Core/Utilities/DictionaryExtensions.cs (+21 -1)
📝 src/iOS.Core/Utilities/WCSessionManager.cs (+38 -62)
📝 src/watchOS/bitwarden/bitwarden WatchKit Extension/Helpers/KeychainHelper.swift (+34 -3)
📝 src/watchOS/bitwarden/bitwarden WatchKit Extension/Localization/en.lproj/Localizable.strings (+1 -0)
📝 src/watchOS/bitwarden/bitwarden WatchKit Extension/Services/StateService.swift (+10 -0)
📝 src/watchOS/bitwarden/bitwarden WatchKit Extension/Utilities/BWState.swift (+1 -0)
➕ src/watchOS/bitwarden/bitwarden WatchKit Extension/Utilities/Queue.swift (+35 -0)
📝 src/watchOS/bitwarden/bitwarden WatchKit Extension/ViewModels/BWStateViewModel.swift (+2 -0)
📝 src/watchOS/bitwarden/bitwarden WatchKit Extension/ViewModels/CipherListViewModel.swift (+20 -0)
📝 src/watchOS/bitwarden/bitwarden WatchKit Extension/WatchConnectivityManager.swift (+26 -7)
📝 src/watchOS/bitwarden/bitwarden.xcodeproj/project.pbxproj (+14 -0)
📝 src/watchOS/bitwarden/bitwarden/WatchConnectivityManager.swift (+6 -5)

📄 Description

Type of change

Bug fix
New feature development
Tech debt (refactoring, code cleanup, dependency upgrades, etc)
Build/deploy pipeline (DevOps)
Other

Objective

Add kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly to the accessible on Keychain items.
Also, added state to show to the user when the Apple Watch Passcode is not set and also a check to see if that situation changed and if a passcode is set afterwards to signal the iPhone to trigger a sync.

Code changes

iPhone app

WatchDeviceService: Subscribed to OnMessagedReceived to trigger the sync when the action is the one intended
WCSessionManager: Improved naming, changed Console.WriteLine to Debug.WriteLine, removed sending application context on main thread, added exception logging, and added method to get message with reply.

Watch app

KeychainHelper: Added kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly accessible on save items and added hasDeviceOwnerAuth to check whether the user has a Passcode set
StateService: Added lackedDeviceOwnerAuthLastTime to track whether the last time the user entered the app the Passcode was on/off
BWState...: Added new state handling
ArrayQueue: Implemented basic queue array, it's not the best performant but we're not going to have many items (most of the times just one); so for now it's fine.
CipherListViewModel: Added check for Passcode and signal to trigger sync if needed
WatchConnectivityManager: Updated consts names, implemented triggering the sync (signaling the iPhone app to trigger the sync) by sending a message and if the session is not activated yet, the message will be queued and when the session gets activated the send method gets called again

Screenshots

Before you submit

Please check for formatting errors (dotnet format --verify-no-changes) (required)
Please add unit tests where it makes sense to do so (encouraged but not required)
If this change requires a documentation update - notify the documentation team
If this change has particular deployment requirements - notify the DevOps team

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/bitwarden/android/pull/2250 **Author:** [@fedemkr](https://github.com/fedemkr) **Created:** 12/16/2022 **Status:** ✅ Merged **Merged:** 12/22/2022 **Merged by:** [@vvolkgang](https://github.com/vvolkgang) **Base:** `master` ← **Head:** `EC-835-add-device-only-accessible-keychain` --- ### 📝 Commits (6) - [`76659eb`](https://github.com/bitwarden/android/commit/76659eb1910d358c2bf3954c28dfb165c6a763ea) EC-835 Added in the Watch app keychain accessible when passcode set this device only and when the passcode is set to signal the iPhone to trigger a sync on opening the watch app - [`86ceaac`](https://github.com/bitwarden/android/commit/86ceaac4bccd4689ab2b4a8cc62a91bbbf4bab43) Merge branch 'master' into EC-835-add-device-only-accessible-keychain - [`17dd761`](https://github.com/bitwarden/android/commit/17dd761f11ade876c6da42686625d63c9fe73f1e) EC-835 Embed LocalAuthentication framework into the watch app to fix no such module when importing it - [`504f713`](https://github.com/bitwarden/android/commit/504f713d5534d44732d451b40c557e808346157d) Merge branch 'master' into EC-835-add-device-only-accessible-keychain - [`b975bb1`](https://github.com/bitwarden/android/commit/b975bb19154d51c7da5be8519dd4c6f9f271539b) EC-835 Changed approach to check if Watch has passcode enabled by using Keychain accessible kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly instead of LAContext - [`9f2df33`](https://github.com/bitwarden/android/commit/9f2df332f308f0a8c6a63a5bb0feddea54f0fe43) EC-835 Fix weird error saying unassigned local variable on the CI compiler. It seems it doesn't realize of the full condition ### 📊 Changes **13 files changed** (+225 additions, -78 deletions) <details> <summary>View changed files</summary> 📝 `src/iOS.Core/Services/WatchDeviceService.cs` (+17 -0) 📝 `src/iOS.Core/Utilities/DictionaryExtensions.cs` (+21 -1) 📝 `src/iOS.Core/Utilities/WCSessionManager.cs` (+38 -62) 📝 `src/watchOS/bitwarden/bitwarden WatchKit Extension/Helpers/KeychainHelper.swift` (+34 -3) 📝 `src/watchOS/bitwarden/bitwarden WatchKit Extension/Localization/en.lproj/Localizable.strings` (+1 -0) 📝 `src/watchOS/bitwarden/bitwarden WatchKit Extension/Services/StateService.swift` (+10 -0) 📝 `src/watchOS/bitwarden/bitwarden WatchKit Extension/Utilities/BWState.swift` (+1 -0) ➕ `src/watchOS/bitwarden/bitwarden WatchKit Extension/Utilities/Queue.swift` (+35 -0) 📝 `src/watchOS/bitwarden/bitwarden WatchKit Extension/ViewModels/BWStateViewModel.swift` (+2 -0) 📝 `src/watchOS/bitwarden/bitwarden WatchKit Extension/ViewModels/CipherListViewModel.swift` (+20 -0) 📝 `src/watchOS/bitwarden/bitwarden WatchKit Extension/WatchConnectivityManager.swift` (+26 -7) 📝 `src/watchOS/bitwarden/bitwarden.xcodeproj/project.pbxproj` (+14 -0) 📝 `src/watchOS/bitwarden/bitwarden/WatchConnectivityManager.swift` (+6 -5) </details> ### 📄 Description ## Type of change - [ ] Bug fix - [X] New feature development - [ ] Tech debt (refactoring, code cleanup, dependency upgrades, etc) - [ ] Build/deploy pipeline (DevOps) - [ ] Other ## Objective  Add `kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly` to the accessible on Keychain items. Also, added state to show to the user when the Apple Watch Passcode is not set and also a check to see if that situation changed and if a passcode is set afterwards to signal the iPhone to trigger a sync. ## Code changes   ### iPhone app * **WatchDeviceService:** Subscribed to `OnMessagedReceived` to trigger the sync when the action is the one intended * **WCSessionManager:** Improved naming, changed `Console.WriteLine` to `Debug.WriteLine`, removed sending application context on main thread, added exception logging, and added method to get message with reply. ### Watch app * **KeychainHelper:** Added `kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly` accessible on save items and added `hasDeviceOwnerAuth` to check whether the user has a Passcode set * **StateService:** Added `lackedDeviceOwnerAuthLastTime` to track whether the last time the user entered the app the Passcode was on/off * **BWState...:** Added new state handling * **ArrayQueue:** Implemented basic queue array, it's not the best performant but we're not going to have many items (most of the times just one); so for now it's fine. * **CipherListViewModel:** Added check for Passcode and signal to trigger sync if needed * **WatchConnectivityManager:** Updated consts names, implemented triggering the sync (signaling the iPhone app to trigger the sync) by sending a message and if the session is not activated yet, the message will be queued and when the session gets activated the send method gets called again ## Screenshots  <img width="314" alt="Apple Watch No Passcode State" src="https://user-images.githubusercontent.com/15682323/208194775-0a9a998c-1d97-4ce5-a60f-7fd45907de8b.PNG"> ## Before you submit - Please check for formatting errors (`dotnet format --verify-no-changes`) (required) - Please add **unit tests** where it makes sense to do so (encouraged but not required) - If this change requires a **documentation update** - notify the documentation team - If this change has particular **deployment requirements** - notify the DevOps team --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2025-11-26 23:33:04 -06:00

GiteaMirror closed this issue