25 lines
1.4 KiB
Markdown
25 lines
1.4 KiB
Markdown
# SecureStorage
|
|
|
|
This adapter stores the TV token, certificate pin, and pairing state in the
|
|
iPhone Keychain under an opaque television UUID. It is injected through
|
|
`KeychainClient` for deterministic tests and conforms to the frozen
|
|
`TVAuthorizationStore` protocol from `TVTransport`.
|
|
|
|
The candidate accessibility is `kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly`:
|
|
it is the narrowest device-only option that can support a phone-lock relay after
|
|
the first unlock. It is unavailable before the first unlock after reboot and has
|
|
not yet been validated on a signed iPhone. The stronger
|
|
`WhenUnlockedThisDeviceOnly` option remains available for a deployment that
|
|
does not require locked-phone relay.
|
|
|
|
Certificate trust is fail-closed. A self-signed certificate is accepted only
|
|
after an explicit user approval supplied to `approveCertificate`; the exact
|
|
SHA-256 leaf fingerprint is then pinned to that opaque TV ID. A changed
|
|
fingerprint returns `requiresReapproval` and is never silently accepted. The
|
|
stored source records that first-use fingerprinting came from an unauthenticated
|
|
connection, so it is not presented as proof of TV identity.
|
|
|
|
`forgetTelevision` removes the complete Keychain record. `deleteToken` revokes
|
|
pairing while preserving the trust pin; `deleteTrust` removes trust material.
|
|
Neither tokens nor trust records are sent to WatchConnectivity or cloud storage.
|