1.4 KiB
SecureStorage
This adapter stores the TV token, certificate pin, and pairing state in the
iPhone Keychain under an opaque television UUID. It is injected through
KeychainClient for deterministic tests and conforms to the frozen
TVAuthorizationStore protocol from TVTransport.
The candidate accessibility is kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly:
it is the narrowest device-only option that can support a phone-lock relay after
the first unlock. It is unavailable before the first unlock after reboot and has
not yet been validated on a signed iPhone. The stronger
WhenUnlockedThisDeviceOnly option remains available for a deployment that
does not require locked-phone relay.
Certificate trust is fail-closed. A self-signed certificate is accepted only
after an explicit user approval supplied to approveCertificate; the exact
SHA-256 leaf fingerprint is then pinned to that opaque TV ID. A changed
fingerprint returns requiresReapproval and is never silently accepted. The
stored source records that first-use fingerprinting came from an unauthenticated
connection, so it is not presented as proof of TV identity.
forgetTelevision removes the complete Keychain record. deleteToken revokes
pairing while preserving the trust pin; deleteTrust removes trust material.
Neither tokens nor trust records are sent to WatchConnectivity or cloud storage.