Compare commits
No commits in common. "main" and "v1.3.0" have entirely different histories.
12 changed files with 2 additions and 1061 deletions
1
.gitignore
vendored
1
.gitignore
vendored
|
|
@ -5,4 +5,3 @@
|
||||||
Package.resolved
|
Package.resolved
|
||||||
xcuserdata/
|
xcuserdata/
|
||||||
DerivedData/
|
DerivedData/
|
||||||
build/
|
|
||||||
|
|
|
||||||
77
CHANGELOG.md
77
CHANGELOG.md
|
|
@ -4,83 +4,6 @@ Alle Änderungen werden hier dokumentiert. Format orientiert an
|
||||||
[Keep a Changelog](https://keepachangelog.com), Versionierung nach
|
[Keep a Changelog](https://keepachangelog.com), Versionierung nach
|
||||||
[Semver](https://semver.org).
|
[Semver](https://semver.org).
|
||||||
|
|
||||||
## [1.5.1] — 2026-05-17
|
|
||||||
|
|
||||||
Patch — KeychainStore-Migration-Fallback. Bisher haben die mana-Apps
|
|
||||||
`keychainAccessGroup: nil` gesetzt; Apple legt das Item dann im
|
|
||||||
default-bucket (`$(AppIdentifierPrefix).$(BundleId)`) ab. Beim
|
|
||||||
Wechsel auf eine explizite `accessGroup` (Apps werden mit v1.5.1
|
|
||||||
nachgezogen) hätten User sonst beim ersten Start einen Logout
|
|
||||||
gesehen, weil Apples Read-mit-Group das alte Item nicht immer
|
|
||||||
liefert.
|
|
||||||
|
|
||||||
### Verändert
|
|
||||||
|
|
||||||
- `KeychainStore.getString(for:)` — bei `accessGroup != nil` und
|
|
||||||
einem Miss wird einmalig ohne `kSecAttrAccessGroup` re-queryt.
|
|
||||||
Findet sich der alte Eintrag im default-bucket, wird er in den
|
|
||||||
expliziten Bucket migriert und der alte gelöscht. Transparent für
|
|
||||||
alle Caller — `getString` liefert wie gewohnt den Wert zurück.
|
|
||||||
|
|
||||||
### Migrations-Hinweis
|
|
||||||
|
|
||||||
- Apps, die `keychainAccessGroup` ab v1.5.1 explizit setzen, brauchen
|
|
||||||
keinen Logout zu erwarten. Apps, die weiterhin `nil` setzen, sind
|
|
||||||
von dem Fallback nicht betroffen (er greift nur bei `accessGroup
|
|
||||||
!= nil`).
|
|
||||||
|
|
||||||
## [1.5.0] — 2026-05-14
|
|
||||||
|
|
||||||
Minor — `getProfile()` + `ProfileInfo`. Apps können den 2FA-Status
|
|
||||||
des eingeloggten Users lesen, damit AccountView entscheidet ob
|
|
||||||
"Aktivieren" oder "Deaktivieren" angezeigt wird.
|
|
||||||
|
|
||||||
### Neu
|
|
||||||
|
|
||||||
- `ProfileInfo` (public struct) — `id`, `email`, `name`,
|
|
||||||
`emailVerified`, `twoFactorEnabled`.
|
|
||||||
- `AuthClient.getProfile() -> ProfileInfo` — lädt aktuelles Profil
|
|
||||||
vom Server (`GET /api/v1/auth/profile` → Better Auths
|
|
||||||
`/api/auth/get-session`). Nutzt Session-Token als Bearer.
|
|
||||||
|
|
||||||
### Tests
|
|
||||||
|
|
||||||
- 4 neue Tests (twoFactor-on, twoFactor-off, ohne Session,
|
|
||||||
unauthorized). 70/70 grün.
|
|
||||||
|
|
||||||
## [1.4.0] — 2026-05-14
|
|
||||||
|
|
||||||
Minor — 2FA-Enrollment (Mini-Sprint B). Setzt Mini-Sprint A
|
|
||||||
(`v1.3.0`) voraus. Komplett additiv.
|
|
||||||
|
|
||||||
### ManaCore — 2FA-Enrollment
|
|
||||||
|
|
||||||
- `TotpEnrollment` (public struct) — `totpURI` (für QR-Code-Display)
|
|
||||||
+ `backupCodes` (Liste).
|
|
||||||
- `AuthClient.enrollTotp(password:) -> TotpEnrollment` — aktiviert
|
|
||||||
TOTP-2FA; Server generiert Secret + Backup-Codes.
|
|
||||||
- `AuthClient.disableTotp(password:)` — deaktiviert wieder.
|
|
||||||
- `AuthClient.getTotpUri(password:) -> String` — Re-Display für
|
|
||||||
zweites Authenticator-Gerät.
|
|
||||||
- `AuthClient.regenerateBackupCodes(password:) -> [String]` — neue
|
|
||||||
Codes, alte werden ungültig.
|
|
||||||
|
|
||||||
Alle vier Methoden senden Bearer-Header mit Session-Token (Wire-
|
|
||||||
Konvention für mana-auth-Account-Endpoints).
|
|
||||||
|
|
||||||
### Server-Side Voraussetzung
|
|
||||||
|
|
||||||
`mana-auth` ≥ Commit der Wrapper-Endpoints:
|
|
||||||
- `POST /api/v1/auth/two-factor/enable`
|
|
||||||
- `POST /api/v1/auth/two-factor/disable`
|
|
||||||
- `POST /api/v1/auth/two-factor/get-totp-uri`
|
|
||||||
- `POST /api/v1/auth/two-factor/generate-backup-codes`
|
|
||||||
|
|
||||||
### Tests
|
|
||||||
|
|
||||||
- 7 neue Tests (Success-Pfade aller vier Methoden, leeres Passwort,
|
|
||||||
ohne Session, falsches Passwort). 66/66 grün.
|
|
||||||
|
|
||||||
## [1.3.0] — 2026-05-14
|
## [1.3.0] — 2026-05-14
|
||||||
|
|
||||||
Minor — 2FA-Login-Challenge (Mini-Sprint A). Apps mit aktiviertem
|
Minor — 2FA-Login-Challenge (Mini-Sprint A). Apps mit aktiviertem
|
||||||
|
|
|
||||||
|
|
@ -481,255 +481,3 @@ private struct TwoFactorVerifyResponse: Decodable {
|
||||||
let accessToken: String?
|
let accessToken: String?
|
||||||
let refreshToken: String?
|
let refreshToken: String?
|
||||||
}
|
}
|
||||||
|
|
||||||
// MARK: - Two-Factor (Enrollment)
|
|
||||||
|
|
||||||
/// Ergebnis von ``AuthClient/enrollTotp(password:)``: enthält die
|
|
||||||
/// otpauth-URI (für QR-Code-Display) und die Backup-Codes. Backup-
|
|
||||||
/// Codes sind einmalig nutzbar und sollten dem User zum Sichern
|
|
||||||
/// (Kopieren/Drucken) angeboten werden — der Server zeigt sie nie
|
|
||||||
/// mehr.
|
|
||||||
public struct TotpEnrollment: Sendable, Equatable {
|
|
||||||
/// `otpauth://totp/Issuer:email?secret=...&...`-URI. Direkt als
|
|
||||||
/// QR-Code rendern (z.B. via `CIFilter.qrCodeGenerator`).
|
|
||||||
public let totpURI: String
|
|
||||||
|
|
||||||
/// Liste der Backup-Codes (üblich 10 Stück). Der User sollte sie
|
|
||||||
/// sicher aufbewahren — bei Verlust des TOTP-Geräts sind sie der
|
|
||||||
/// einzige Fallback. Server merkt sich nur Hashes; bei Verbrauch
|
|
||||||
/// werden sie als consumed markiert.
|
|
||||||
public let backupCodes: [String]
|
|
||||||
}
|
|
||||||
|
|
||||||
public extension AuthClient {
|
|
||||||
/// Aktiviert TOTP-2FA für den aktuellen Account.
|
|
||||||
///
|
|
||||||
/// Re-Auth via aktuellem Passwort. Bei Erfolg generiert der Server
|
|
||||||
/// ein TOTP-Secret und gibt die otpauth-URI + Backup-Codes zurück.
|
|
||||||
/// Die App rendert die URI als QR-Code, der User scannt mit
|
|
||||||
/// Authenticator-App und gibt zur Bestätigung den ersten Code ein —
|
|
||||||
/// dieser zweite Schritt läuft über die regulären
|
|
||||||
/// ``verifyTotp(code:trustDevice:)``-Methode oder einen Re-Auth
|
|
||||||
/// signIn → twoFactorRequired-Flow (der Server entscheidet).
|
|
||||||
///
|
|
||||||
/// - Important: Nutzt den Session-Token als Bearer (Wire-Konvention
|
|
||||||
/// für mana-auth-Account-Endpoints, siehe Doc-Header dieser Datei).
|
|
||||||
func enrollTotp(password: String) async throws -> TotpEnrollment {
|
|
||||||
guard !password.isEmpty else {
|
|
||||||
throw AuthError.validation(message: "Passwort ist erforderlich")
|
|
||||||
}
|
|
||||||
|
|
||||||
let body = TotpEnableRequest(password: password)
|
|
||||||
let (data, http) = try await postJSON(
|
|
||||||
path: "/api/v1/auth/two-factor/enable",
|
|
||||||
body: body,
|
|
||||||
authenticated: true
|
|
||||||
)
|
|
||||||
guard http.statusCode == 200 else {
|
|
||||||
throw AuthError.classify(
|
|
||||||
status: http.statusCode,
|
|
||||||
data: data,
|
|
||||||
retryAfterHeader: http.retryAfterSeconds
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
let decoded = try JSONDecoder().decode(TotpEnableResponse.self, from: data)
|
|
||||||
guard let uri = decoded.totpURI else {
|
|
||||||
throw AuthError.decoding("totpURI fehlt in Enroll-Antwort")
|
|
||||||
}
|
|
||||||
CoreLog.auth.info("2FA TOTP enrollment initiated")
|
|
||||||
return TotpEnrollment(totpURI: uri, backupCodes: decoded.backupCodes ?? [])
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Deaktiviert TOTP-2FA für den aktuellen Account. Re-Auth via
|
|
||||||
/// Passwort.
|
|
||||||
func disableTotp(password: String) async throws {
|
|
||||||
guard !password.isEmpty else {
|
|
||||||
throw AuthError.validation(message: "Passwort ist erforderlich")
|
|
||||||
}
|
|
||||||
|
|
||||||
let body = TotpEnableRequest(password: password)
|
|
||||||
let (data, http) = try await postJSON(
|
|
||||||
path: "/api/v1/auth/two-factor/disable",
|
|
||||||
body: body,
|
|
||||||
authenticated: true
|
|
||||||
)
|
|
||||||
guard http.statusCode == 200 else {
|
|
||||||
throw AuthError.classify(
|
|
||||||
status: http.statusCode,
|
|
||||||
data: data,
|
|
||||||
retryAfterHeader: http.retryAfterSeconds
|
|
||||||
)
|
|
||||||
}
|
|
||||||
CoreLog.auth.info("2FA TOTP disabled")
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Liefert die otpauth-URI des aktuellen TOTP-Secrets. Nützlich
|
|
||||||
/// wenn der User den QR-Code erneut sehen will (z.B. zweites
|
|
||||||
/// Gerät einrichten). Re-Auth via Passwort.
|
|
||||||
///
|
|
||||||
/// - Returns: `otpauth://totp/…`-URI, direkt als QR-Code renderbar.
|
|
||||||
func getTotpUri(password: String) async throws -> String {
|
|
||||||
guard !password.isEmpty else {
|
|
||||||
throw AuthError.validation(message: "Passwort ist erforderlich")
|
|
||||||
}
|
|
||||||
|
|
||||||
let body = TotpEnableRequest(password: password)
|
|
||||||
let (data, http) = try await postJSON(
|
|
||||||
path: "/api/v1/auth/two-factor/get-totp-uri",
|
|
||||||
body: body,
|
|
||||||
authenticated: true
|
|
||||||
)
|
|
||||||
guard http.statusCode == 200 else {
|
|
||||||
throw AuthError.classify(
|
|
||||||
status: http.statusCode,
|
|
||||||
data: data,
|
|
||||||
retryAfterHeader: http.retryAfterSeconds
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
let decoded = try JSONDecoder().decode(TotpEnableResponse.self, from: data)
|
|
||||||
guard let uri = decoded.totpURI else {
|
|
||||||
throw AuthError.decoding("totpURI fehlt in get-totp-uri-Antwort")
|
|
||||||
}
|
|
||||||
return uri
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Regeneriert die Backup-Codes. Alte Codes werden ungültig. Der
|
|
||||||
/// User sollte die neuen direkt sichern.
|
|
||||||
func regenerateBackupCodes(password: String) async throws -> [String] {
|
|
||||||
guard !password.isEmpty else {
|
|
||||||
throw AuthError.validation(message: "Passwort ist erforderlich")
|
|
||||||
}
|
|
||||||
|
|
||||||
let body = TotpEnableRequest(password: password)
|
|
||||||
let (data, http) = try await postJSON(
|
|
||||||
path: "/api/v1/auth/two-factor/generate-backup-codes",
|
|
||||||
body: body,
|
|
||||||
authenticated: true
|
|
||||||
)
|
|
||||||
guard http.statusCode == 200 else {
|
|
||||||
throw AuthError.classify(
|
|
||||||
status: http.statusCode,
|
|
||||||
data: data,
|
|
||||||
retryAfterHeader: http.retryAfterSeconds
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
let decoded = try JSONDecoder().decode(TotpEnableResponse.self, from: data)
|
|
||||||
guard let codes = decoded.backupCodes else {
|
|
||||||
throw AuthError.decoding("backupCodes fehlen in Antwort")
|
|
||||||
}
|
|
||||||
return codes
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
private struct TotpEnableRequest: Encodable {
|
|
||||||
let password: String
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Antwort-Format für alle Enrollment-Endpoints. Felder sind optional
|
|
||||||
/// damit derselbe Type für `enable` (beide), `get-totp-uri` (nur URI)
|
|
||||||
/// und `generate-backup-codes` (nur Codes) dekodierbar ist.
|
|
||||||
private struct TotpEnableResponse: Decodable {
|
|
||||||
let totpURI: String?
|
|
||||||
let backupCodes: [String]?
|
|
||||||
}
|
|
||||||
|
|
||||||
// MARK: - Profile
|
|
||||||
|
|
||||||
/// Subset des Server-User-Profiles, das die Apps für UI-Entscheidungen
|
|
||||||
/// brauchen. Wird von ``AuthClient/getProfile()`` geliefert.
|
|
||||||
///
|
|
||||||
/// Server-Quelle: `GET /api/v1/auth/profile` (→ Better Auths
|
|
||||||
/// `/api/auth/get-session`). Returnt `{user: {…}, session: {…}}`.
|
|
||||||
/// Wir nehmen nur die UI-relevanten Felder mit.
|
|
||||||
public struct ProfileInfo: Sendable, Equatable {
|
|
||||||
public let id: String
|
|
||||||
public let email: String
|
|
||||||
public let name: String?
|
|
||||||
public let emailVerified: Bool
|
|
||||||
/// `true` wenn der User TOTP-2FA aktiviert hat. Apps zeigen
|
|
||||||
/// dann den Disable-/Regenerate-Pfad statt des Enroll-Wizards.
|
|
||||||
public let twoFactorEnabled: Bool
|
|
||||||
|
|
||||||
public init(
|
|
||||||
id: String,
|
|
||||||
email: String,
|
|
||||||
name: String?,
|
|
||||||
emailVerified: Bool,
|
|
||||||
twoFactorEnabled: Bool
|
|
||||||
) {
|
|
||||||
self.id = id
|
|
||||||
self.email = email
|
|
||||||
self.name = name
|
|
||||||
self.emailVerified = emailVerified
|
|
||||||
self.twoFactorEnabled = twoFactorEnabled
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
public extension AuthClient {
|
|
||||||
/// Lädt das aktuelle Profil des eingeloggten Users vom Server.
|
|
||||||
///
|
|
||||||
/// - Important: Nutzt den Session-Token als Bearer (Wire-Konvention
|
|
||||||
/// für mana-auth-Endpoints, siehe Doc-Header dieser Datei).
|
|
||||||
///
|
|
||||||
/// - Throws: ``AuthError/notSignedIn`` ohne Session,
|
|
||||||
/// ``AuthError/unauthorized`` wenn Server den Token rejected,
|
|
||||||
/// Netzwerk-Cases.
|
|
||||||
func getProfile() async throws -> ProfileInfo {
|
|
||||||
let token = try currentSessionToken()
|
|
||||||
let url = config.authBaseURL.appending(path: "/api/v1/auth/profile")
|
|
||||||
var request = URLRequest(url: url)
|
|
||||||
request.httpMethod = "GET"
|
|
||||||
request.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
|
|
||||||
|
|
||||||
let (data, http): (Data, HTTPURLResponse)
|
|
||||||
do {
|
|
||||||
let (d, r) = try await session.data(for: request)
|
|
||||||
guard let h = r as? HTTPURLResponse else {
|
|
||||||
throw AuthError.networkFailure("Keine HTTP-Antwort")
|
|
||||||
}
|
|
||||||
data = d
|
|
||||||
http = h
|
|
||||||
} catch let error as URLError {
|
|
||||||
throw AuthError.networkFailure(error.localizedDescription)
|
|
||||||
}
|
|
||||||
|
|
||||||
guard http.statusCode == 200 else {
|
|
||||||
throw AuthError.classify(
|
|
||||||
status: http.statusCode,
|
|
||||||
data: data,
|
|
||||||
retryAfterHeader: http.retryAfterSeconds
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
let envelope = try JSONDecoder().decode(ProfileEnvelope.self, from: data)
|
|
||||||
guard let user = envelope.user else {
|
|
||||||
throw AuthError.decoding("user-Feld fehlt in profile-Antwort")
|
|
||||||
}
|
|
||||||
|
|
||||||
return ProfileInfo(
|
|
||||||
id: user.id,
|
|
||||||
email: user.email,
|
|
||||||
name: user.name,
|
|
||||||
emailVerified: user.emailVerified ?? false,
|
|
||||||
twoFactorEnabled: user.twoFactorEnabled ?? false
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/// Wire-Format-Hülle für `GET /api/v1/auth/profile`. Better-Auth-
|
|
||||||
/// `/api/auth/get-session` returnt `{user: {...}, session: {...}}`;
|
|
||||||
/// wir lesen `user` und ignorieren `session`.
|
|
||||||
private struct ProfileEnvelope: Decodable {
|
|
||||||
let user: ProfileUser?
|
|
||||||
}
|
|
||||||
|
|
||||||
private struct ProfileUser: Decodable {
|
|
||||||
let id: String
|
|
||||||
let email: String
|
|
||||||
let name: String?
|
|
||||||
let emailVerified: Bool?
|
|
||||||
let twoFactorEnabled: Bool?
|
|
||||||
}
|
|
||||||
|
|
|
||||||
|
|
@ -61,40 +61,10 @@ public final class KeychainStore: Sendable {
|
||||||
query[kSecMatchLimit] = kSecMatchLimitOne
|
query[kSecMatchLimit] = kSecMatchLimitOne
|
||||||
var result: AnyObject?
|
var result: AnyObject?
|
||||||
let status = SecItemCopyMatching(query as CFDictionary, &result)
|
let status = SecItemCopyMatching(query as CFDictionary, &result)
|
||||||
if status == errSecSuccess, let data = result as? Data {
|
guard status == errSecSuccess, let data = result as? Data else {
|
||||||
return String(data: data, encoding: .utf8)
|
|
||||||
}
|
|
||||||
|
|
||||||
// One-shot migration: bis v1.2.0 haben die mana-Apps Keychain-
|
|
||||||
// Items ohne explizite `kSecAttrAccessGroup` geschrieben. Apple
|
|
||||||
// hat sie dann im default-bucket (= `$(AppIdentifierPrefix).$(BundleId)`)
|
|
||||||
// gelandet. Ab v1.2.1 setzen die Apps die accessGroup explizit
|
|
||||||
// auf denselben Identifier. In den meisten Fällen liefert Apple
|
|
||||||
// das alte Item beim Read-mit-Group transparent zurück — wenn
|
|
||||||
// nicht, hat das einen Logout zur Folge. Dieser Fallback liest
|
|
||||||
// den Item nochmal ohne accessGroup, schreibt ihn beim Erfolg
|
|
||||||
// mit accessGroup neu in den expliziten Bucket und löscht den
|
|
||||||
// alten Eintrag.
|
|
||||||
guard accessGroup != nil else { return nil }
|
|
||||||
var fallback: [CFString: Any] = [
|
|
||||||
kSecClass: kSecClassGenericPassword,
|
|
||||||
kSecAttrService: service,
|
|
||||||
kSecAttrAccount: key.rawValue,
|
|
||||||
kSecReturnData: true,
|
|
||||||
kSecMatchLimit: kSecMatchLimitOne,
|
|
||||||
]
|
|
||||||
var fallbackResult: AnyObject?
|
|
||||||
guard SecItemCopyMatching(fallback as CFDictionary, &fallbackResult) == errSecSuccess,
|
|
||||||
let data = fallbackResult as? Data,
|
|
||||||
let value = String(data: data, encoding: .utf8)
|
|
||||||
else {
|
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
try? setString(value, for: key)
|
return String(data: data, encoding: .utf8)
|
||||||
fallback.removeValue(forKey: kSecReturnData)
|
|
||||||
fallback.removeValue(forKey: kSecMatchLimit)
|
|
||||||
SecItemDelete(fallback as CFDictionary)
|
|
||||||
return value
|
|
||||||
}
|
}
|
||||||
|
|
||||||
public func remove(for key: Key) {
|
public func remove(for key: Key) {
|
||||||
|
|
|
||||||
|
|
@ -1,77 +0,0 @@
|
||||||
import Foundation
|
|
||||||
import Testing
|
|
||||||
@testable import ManaCore
|
|
||||||
|
|
||||||
@Suite("AuthClient getProfile")
|
|
||||||
@MainActor
|
|
||||||
struct AuthClientProfileTests {
|
|
||||||
private func signedInAuth() async -> MockedAuth {
|
|
||||||
let mocked = makeMockedAuth()
|
|
||||||
let access = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1MSIsImV4cCI6MjAwMDAwMDAwMH0.sig"
|
|
||||||
mocked.setHandler { _ in
|
|
||||||
(200, Data(#"{"accessToken":"\#(access)","refreshToken":"session-tok"}"#.utf8))
|
|
||||||
}
|
|
||||||
await mocked.auth.signIn(email: "u@x.de", password: "pw")
|
|
||||||
return mocked
|
|
||||||
}
|
|
||||||
|
|
||||||
@Test("getProfile mit twoFactor on")
|
|
||||||
func profileTwoFactorOn() async throws {
|
|
||||||
let mocked = await signedInAuth()
|
|
||||||
let captured = MockURLProtocol.Capture()
|
|
||||||
mocked.setHandler { request in
|
|
||||||
captured.store(request)
|
|
||||||
return (200, Data(#"""
|
|
||||||
{"user":{"id":"u1","email":"u@x.de","name":"Test","emailVerified":true,"twoFactorEnabled":true},
|
|
||||||
"session":{"id":"s1"}}
|
|
||||||
"""#.utf8))
|
|
||||||
}
|
|
||||||
|
|
||||||
let profile = try await mocked.auth.getProfile()
|
|
||||||
#expect(profile.id == "u1")
|
|
||||||
#expect(profile.email == "u@x.de")
|
|
||||||
#expect(profile.name == "Test")
|
|
||||||
#expect(profile.emailVerified == true)
|
|
||||||
#expect(profile.twoFactorEnabled == true)
|
|
||||||
|
|
||||||
let request = try #require(captured.request)
|
|
||||||
#expect(request.httpMethod == "GET")
|
|
||||||
#expect(request.url?.path == "/api/v1/auth/profile")
|
|
||||||
// Bearer-Header trägt den Session-Token
|
|
||||||
#expect(request.value(forHTTPHeaderField: "Authorization") == "Bearer session-tok")
|
|
||||||
}
|
|
||||||
|
|
||||||
@Test("getProfile mit twoFactor off (Feld fehlt)")
|
|
||||||
func profileTwoFactorOff() async throws {
|
|
||||||
let mocked = await signedInAuth()
|
|
||||||
mocked.setHandler { _ in
|
|
||||||
(200, Data(#"""
|
|
||||||
{"user":{"id":"u1","email":"u@x.de","name":null,"emailVerified":true}}
|
|
||||||
"""#.utf8))
|
|
||||||
}
|
|
||||||
|
|
||||||
let profile = try await mocked.auth.getProfile()
|
|
||||||
#expect(profile.twoFactorEnabled == false)
|
|
||||||
#expect(profile.name == nil)
|
|
||||||
}
|
|
||||||
|
|
||||||
@Test("getProfile ohne Session → notSignedIn")
|
|
||||||
func profileNoSession() async {
|
|
||||||
let mocked = makeMockedAuth()
|
|
||||||
await #expect(throws: AuthError.notSignedIn) {
|
|
||||||
try await mocked.auth.getProfile()
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
@Test("getProfile mit abgelaufenem Token → unauthorized")
|
|
||||||
func profileUnauthorized() async {
|
|
||||||
let mocked = await signedInAuth()
|
|
||||||
mocked.setHandler { _ in
|
|
||||||
(401, Data(#"{"error":"UNAUTHORIZED","status":401}"#.utf8))
|
|
||||||
}
|
|
||||||
|
|
||||||
await #expect(throws: AuthError.unauthorized) {
|
|
||||||
try await mocked.auth.getProfile()
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
@ -1,119 +0,0 @@
|
||||||
import Foundation
|
|
||||||
import Testing
|
|
||||||
@testable import ManaCore
|
|
||||||
|
|
||||||
@Suite("AuthClient 2FA-Enrollment")
|
|
||||||
@MainActor
|
|
||||||
struct AuthClientTwoFactorEnrollmentTests {
|
|
||||||
/// Bringt den AuthClient in den `.signedIn`-Status mit einem
|
|
||||||
/// Session-Token für authenticated Calls.
|
|
||||||
private func signedInAuth() async -> MockedAuth {
|
|
||||||
let mocked = makeMockedAuth()
|
|
||||||
let access = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1MSIsImV4cCI6MjAwMDAwMDAwMH0.sig"
|
|
||||||
mocked.setHandler { _ in
|
|
||||||
(200, Data(#"{"accessToken":"\#(access)","refreshToken":"session-tok"}"#.utf8))
|
|
||||||
}
|
|
||||||
await mocked.auth.signIn(email: "u@x.de", password: "pw")
|
|
||||||
return mocked
|
|
||||||
}
|
|
||||||
|
|
||||||
@Test("enrollTotp liefert URI + Backup-Codes")
|
|
||||||
func enrollSuccess() async throws {
|
|
||||||
let mocked = await signedInAuth()
|
|
||||||
let captured = MockURLProtocol.Capture()
|
|
||||||
mocked.setHandler { request in
|
|
||||||
captured.store(request)
|
|
||||||
return (200, Data(#"""
|
|
||||||
{"totpURI":"otpauth://totp/Mana:u@x.de?secret=ABC&issuer=Mana","backupCodes":["a-b-c","d-e-f","g-h-i"]}
|
|
||||||
"""#.utf8))
|
|
||||||
}
|
|
||||||
|
|
||||||
let enrollment = try await mocked.auth.enrollTotp(password: "pw")
|
|
||||||
#expect(enrollment.totpURI.hasPrefix("otpauth://totp/"))
|
|
||||||
#expect(enrollment.backupCodes == ["a-b-c", "d-e-f", "g-h-i"])
|
|
||||||
|
|
||||||
let request = try #require(captured.request)
|
|
||||||
#expect(request.url?.path == "/api/v1/auth/two-factor/enable")
|
|
||||||
// Bearer-Header trägt den Session-Token (nicht JWT)
|
|
||||||
#expect(request.value(forHTTPHeaderField: "Authorization") == "Bearer session-tok")
|
|
||||||
}
|
|
||||||
|
|
||||||
@Test("enrollTotp mit leerem Passwort → validation, kein Server-Call")
|
|
||||||
func enrollEmptyPassword() async {
|
|
||||||
let mocked = await signedInAuth()
|
|
||||||
mocked.setHandler { _ in
|
|
||||||
Issue.record("Server darf nicht aufgerufen werden")
|
|
||||||
return (500, Data())
|
|
||||||
}
|
|
||||||
|
|
||||||
await #expect(throws: AuthError.validation(message: "Passwort ist erforderlich")) {
|
|
||||||
try await mocked.auth.enrollTotp(password: "")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
@Test("enrollTotp ohne Session → notSignedIn")
|
|
||||||
func enrollNoSession() async {
|
|
||||||
let mocked = makeMockedAuth()
|
|
||||||
await #expect(throws: AuthError.notSignedIn) {
|
|
||||||
try await mocked.auth.enrollTotp(password: "pw")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
@Test("disableTotp success")
|
|
||||||
func disableSuccess() async throws {
|
|
||||||
let mocked = await signedInAuth()
|
|
||||||
let captured = MockURLProtocol.Capture()
|
|
||||||
mocked.setHandler { request in
|
|
||||||
captured.store(request)
|
|
||||||
return (200, Data(#"{"success":true}"#.utf8))
|
|
||||||
}
|
|
||||||
|
|
||||||
try await mocked.auth.disableTotp(password: "pw")
|
|
||||||
let request = try #require(captured.request)
|
|
||||||
#expect(request.url?.path == "/api/v1/auth/two-factor/disable")
|
|
||||||
}
|
|
||||||
|
|
||||||
@Test("disableTotp mit falschem Passwort → invalidCredentials")
|
|
||||||
func disableWrongPassword() async {
|
|
||||||
let mocked = await signedInAuth()
|
|
||||||
mocked.setHandler { _ in
|
|
||||||
(401, Data(#"{"error":"INVALID_CREDENTIALS","status":401}"#.utf8))
|
|
||||||
}
|
|
||||||
|
|
||||||
await #expect(throws: AuthError.invalidCredentials) {
|
|
||||||
try await mocked.auth.disableTotp(password: "wrong")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
@Test("getTotpUri liefert URI ohne Backup-Codes")
|
|
||||||
func getUriSuccess() async throws {
|
|
||||||
let mocked = await signedInAuth()
|
|
||||||
mocked.setHandler { _ in
|
|
||||||
(200, Data(#"""
|
|
||||||
{"totpURI":"otpauth://totp/Mana:u@x.de?secret=XYZ&issuer=Mana"}
|
|
||||||
"""#.utf8))
|
|
||||||
}
|
|
||||||
|
|
||||||
let uri = try await mocked.auth.getTotpUri(password: "pw")
|
|
||||||
#expect(uri.hasPrefix("otpauth://totp/"))
|
|
||||||
#expect(uri.contains("secret=XYZ"))
|
|
||||||
}
|
|
||||||
|
|
||||||
@Test("regenerateBackupCodes liefert neue Codes")
|
|
||||||
func regenerateSuccess() async throws {
|
|
||||||
let mocked = await signedInAuth()
|
|
||||||
let captured = MockURLProtocol.Capture()
|
|
||||||
mocked.setHandler { request in
|
|
||||||
captured.store(request)
|
|
||||||
return (200, Data(#"""
|
|
||||||
{"backupCodes":["new-1","new-2","new-3","new-4","new-5"]}
|
|
||||||
"""#.utf8))
|
|
||||||
}
|
|
||||||
|
|
||||||
let codes = try await mocked.auth.regenerateBackupCodes(password: "pw")
|
|
||||||
#expect(codes.count == 5)
|
|
||||||
#expect(codes.first == "new-1")
|
|
||||||
let request = try #require(captured.request)
|
|
||||||
#expect(request.url?.path == "/api/v1/auth/two-factor/generate-backup-codes")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
@ -1,87 +0,0 @@
|
||||||
{
|
|
||||||
"date": "2026-05-12",
|
|
||||||
"day_number": 1,
|
|
||||||
"weekday": "Dienstag",
|
|
||||||
"commits": 1,
|
|
||||||
"authors": [
|
|
||||||
{
|
|
||||||
"name": "Till JS",
|
|
||||||
"count": 1
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"additions": 1151,
|
|
||||||
"deletions": 0,
|
|
||||||
"net_lines": 1151,
|
|
||||||
"files_changed": 23,
|
|
||||||
"new_files": 0,
|
|
||||||
"deleted_files": 0,
|
|
||||||
"session": {
|
|
||||||
"first_commit_at": "2026-05-12T17:13:31.000Z",
|
|
||||||
"last_commit_at": "2026-05-12T17:13:31.000Z",
|
|
||||||
"total_span_minutes": 0,
|
|
||||||
"active_minutes": 0,
|
|
||||||
"pauses": [],
|
|
||||||
"longest_focus_minutes": 0
|
|
||||||
},
|
|
||||||
"top_dirs": [
|
|
||||||
{
|
|
||||||
"path": "Sources/ManaCore/Auth",
|
|
||||||
"pct": 22
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"path": "Sources/ManaTokens/Colors",
|
|
||||||
"pct": 13
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"path": "Sources/ManaTokens/Spacing",
|
|
||||||
"pct": 9
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"path": ".gitignore",
|
|
||||||
"pct": 4
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"path": ".swiftformat",
|
|
||||||
"pct": 4
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"top_extensions": [
|
|
||||||
{
|
|
||||||
"ext": ".swift",
|
|
||||||
"count": 17
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ext": ".md",
|
|
||||||
"count": 3
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ext": ".gitignore",
|
|
||||||
"count": 1
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ext": ".swiftformat",
|
|
||||||
"count": 1
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ext": ".yml",
|
|
||||||
"count": 1
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"tags": [],
|
|
||||||
"commits_list": [
|
|
||||||
{
|
|
||||||
"hash": "df6f67e",
|
|
||||||
"short": "v1.0.0 — initiale Extraktion aus memoro-native",
|
|
||||||
"type": null,
|
|
||||||
"scope": null,
|
|
||||||
"additions": 1151,
|
|
||||||
"deletions": 0,
|
|
||||||
"timestamp": "2026-05-12T19:13:31+02:00"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"review_state": "auto",
|
|
||||||
"llm": {
|
|
||||||
"model": null,
|
|
||||||
"generated_at": null
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
@ -1,83 +0,0 @@
|
||||||
---
|
|
||||||
date: 2026-05-12
|
|
||||||
day: 1
|
|
||||||
view: macher
|
|
||||||
weekday: Dienstag
|
|
||||||
commits: 1
|
|
||||||
review: written
|
|
||||||
---
|
|
||||||
# Dienstag, 2026-05-12 — Tag 1 (Macher-Sicht)
|
|
||||||
|
|
||||||
**v1.0.0 — initiale Extraktion aus memoro-native.** Swift-Package
|
|
||||||
mit zwei Library-Products: `ManaCore` (Auth + Transport) und
|
|
||||||
`ManaTokens` (Vereins-Designwerte aus `mana/docs/THEMING.md`).
|
|
||||||
|
|
||||||
## Stats
|
|
||||||
|
|
||||||
1 Commit, +1 151 / −0 LoC, 23 Files. 17× `.swift`. Top-Dirs:
|
|
||||||
`Sources/ManaCore/Auth` (22 %), `Sources/ManaTokens/Colors` (13 %),
|
|
||||||
`Sources/ManaTokens/Spacing` (9 %).
|
|
||||||
|
|
||||||
## Was im Initial-Commit drin ist
|
|
||||||
|
|
||||||
- **ManaCore.Auth** — `AuthClient` (Login + Refresh gegen
|
|
||||||
`/api/v1/auth/login` und `/api/v1/auth/refresh`),
|
|
||||||
`KeychainStorage` für Access/Refresh-Token-Persistenz, JWT-Decode
|
|
||||||
+ Expiry-Check, 401-Retry-Loop in `Transport`.
|
|
||||||
- **ManaCore.Transport** — URLSession-Wrapper, protocol-injected
|
|
||||||
für Tests, automatisches Refresh-on-401.
|
|
||||||
- **ManaTokens** — Vereins-Farben (`mana`, `forest`, demnächst
|
|
||||||
weitere Themes), Spacing-Skala, Typography-Konstanten. Spiegelt
|
|
||||||
`mana/docs/THEMING.md` 1:1.
|
|
||||||
- **Verpackung**: `Package.swift` mit Swift 6.0, iOS 18 / macOS 15,
|
|
||||||
Strict Concurrency komplett.
|
|
||||||
|
|
||||||
## Architektur-Entscheidungen
|
|
||||||
|
|
||||||
- **Genau zwei Library-Products.** `ManaCore` + `ManaTokens`. UI-
|
|
||||||
Komponenten (`ManaUI`) entstehen in einem separaten Repo
|
|
||||||
(`mana-swift-ui`, Phase ε). Hier nicht.
|
|
||||||
- **Keine externen Dependencies.** Nur Foundation, Security, OSLog,
|
|
||||||
Combine. Begründung Compliance + Build-Stabilität. Kein Alamofire,
|
|
||||||
kein Sentry.
|
|
||||||
- **Public API ist `Sendable`.** Swift-6-Concurrency strikt; jeder
|
|
||||||
Cross-Actor-Type annotiert.
|
|
||||||
- **App injiziert ihre Config.** `authBaseURL`, `keychainService`,
|
|
||||||
`keychainAccessGroup` kommen vom Caller. ManaCore hat keine
|
|
||||||
Hardcoded-App-Konstanten außer den mana-auth-Endpoint-Pfaden
|
|
||||||
(`/api/v1/auth/login`, `/api/v1/auth/refresh`).
|
|
||||||
- **OSLog statt print/Sentry.** ManaCore loggt unter Subsystem
|
|
||||||
`ev.mana.core`. Apps haben ihr eigenes Subsystem.
|
|
||||||
- **Tests gegen reine Logik**, nicht echtes Netzwerk. URLSession
|
|
||||||
über Protokoll-Injection mockbar.
|
|
||||||
- **Keine app-spezifischen Annahmen.** ManaCore weiß nichts über
|
|
||||||
Memos, Decks, Meals. Wenn das Paket „etwas für Memoro" lernen
|
|
||||||
will, gehört es zurück in memoro-native.
|
|
||||||
|
|
||||||
## Trade-offs
|
|
||||||
|
|
||||||
- **Wortwörtliche Extraktion**, keine spekulative Verallgemeinerung.
|
|
||||||
Die `AuthClient`-API ist die alte memoro-Variante; falls neue
|
|
||||||
Apps andere Bedürfnisse haben, lieber additiv erweitern als
|
|
||||||
vorab abstrahieren.
|
|
||||||
- **+1 151 LoC in einem Commit** ist groß, aber sauber: das war
|
|
||||||
ein Move-Commit, kein Feature-Commit. Hätte man auf Auth/
|
|
||||||
Transport/Tokens splitten können — pragmatisch zusammen, weil
|
|
||||||
alle drei aus demselben Source-Repo kamen.
|
|
||||||
- **Initiale Versions-Politik strikt Semver.** Patch-Bugfix,
|
|
||||||
Minor-additiv, Major-breaking. Pflege-Politik: letzte zwei
|
|
||||||
Major-Versionen.
|
|
||||||
|
|
||||||
## Offene Punkte
|
|
||||||
|
|
||||||
- **`mana-swift-ui`-Repo** existiert noch nicht — UI-Komponenten
|
|
||||||
bleiben pro App, bis Phase ε in einem dritten Repo extrahiert
|
|
||||||
wird (kam morgen, siehe `mana-swift-ui` Tag 1).
|
|
||||||
- **2FA-Endpoint-Spezifikation** im AuthClient fehlt — Memoro hatte
|
|
||||||
noch kein 2FA. Wenn die UI-Schicht 2FA bekommt, muss ManaCore
|
|
||||||
nachziehen.
|
|
||||||
- **Refresh-Token-Rotation** (`mana-auth` hat dafür einen Endpoint)
|
|
||||||
ist in AuthClient noch nicht. Patch-Bump-Kandidat.
|
|
||||||
- **Theme-Variants** in ManaTokens noch hartcodiert auf `mana` und
|
|
||||||
`forest`. Die im THEMING.md beschriebenen weiteren Themes
|
|
||||||
(`spruce`, `cardecky`, …) folgen.
|
|
||||||
|
|
@ -1,27 +0,0 @@
|
||||||
---
|
|
||||||
date: 2026-05-12
|
|
||||||
day: 1
|
|
||||||
view: spieler
|
|
||||||
weekday: Dienstag
|
|
||||||
commits: 1
|
|
||||||
review: written
|
|
||||||
---
|
|
||||||
# Dienstag, 2026-05-12 — Tag 1
|
|
||||||
|
|
||||||
Dieses Paket ist die Grundlage, die alle Vereins-iPhone-/Mac-Apps
|
|
||||||
gemeinsam haben — Anmelden, Token-Verwaltung, Vereins-Farben und
|
|
||||||
-Abstände. Bisher steckte das in der Memoro-App; heute lebt es
|
|
||||||
eigenständig.
|
|
||||||
|
|
||||||
## Was sich für dich ändert
|
|
||||||
|
|
||||||
Direkt: nichts, was du in einer App sehen würdest. Indirekt: alle
|
|
||||||
zukünftigen mana-Apps (Cards, Manaspur, Nutriphi, weitere) bekommen
|
|
||||||
dieselbe Anmelde-Mechanik, dieselben Vereins-Farben — automatisch.
|
|
||||||
Was du in einer App lernst, fühlt sich in der nächsten gleich an.
|
|
||||||
|
|
||||||
## Hintergrund
|
|
||||||
|
|
||||||
Memoro hatte „mana-auth-Login" schon, Cards musste es kopieren,
|
|
||||||
Manaspur hätte es ein drittes Mal nachgebaut. Stattdessen liegt es
|
|
||||||
jetzt einmal an einem Ort.
|
|
||||||
|
|
@ -1,172 +0,0 @@
|
||||||
{
|
|
||||||
"date": "2026-05-13",
|
|
||||||
"day_number": 2,
|
|
||||||
"weekday": "Mittwoch",
|
|
||||||
"commits": 8,
|
|
||||||
"authors": [
|
|
||||||
{
|
|
||||||
"name": "Till JS",
|
|
||||||
"count": 8
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"additions": 5427,
|
|
||||||
"deletions": 2895,
|
|
||||||
"net_lines": 2532,
|
|
||||||
"files_changed": 408,
|
|
||||||
"new_files": 0,
|
|
||||||
"deleted_files": 0,
|
|
||||||
"session": {
|
|
||||||
"first_commit_at": "2026-05-13T15:18:23.000Z",
|
|
||||||
"last_commit_at": "2026-05-13T23:07:55.000Z",
|
|
||||||
"total_span_minutes": 470,
|
|
||||||
"active_minutes": 62,
|
|
||||||
"pauses": [
|
|
||||||
{
|
|
||||||
"from": "17:18",
|
|
||||||
"to": "19:22",
|
|
||||||
"minutes": 124
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"from": "19:35",
|
|
||||||
"to": "22:16",
|
|
||||||
"minutes": 160
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"from": "22:16",
|
|
||||||
"to": "00:20",
|
|
||||||
"minutes": 124
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"longest_focus_minutes": 48
|
|
||||||
},
|
|
||||||
"top_dirs": [
|
|
||||||
{
|
|
||||||
"path": "build/mana-swift-core.build/Release",
|
|
||||||
"pct": 19
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"path": "build/SwiftExplicitPrecompiledModules/1HSBLLLL9AUU4",
|
|
||||||
"pct": 15
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"path": "build/SwiftExplicitPrecompiledModules/1KYQZQ1R5RV9Z",
|
|
||||||
"pct": 15
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"path": "build/SwiftExplicitPrecompiledModules/33L8UAO7QRF6J",
|
|
||||||
"pct": 9
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"path": "build/SwiftExplicitPrecompiledModules/1IZ03QLWZJUL2",
|
|
||||||
"pct": 9
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"top_extensions": [
|
|
||||||
{
|
|
||||||
"ext": ".pcm",
|
|
||||||
"count": 620
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ext": ".json",
|
|
||||||
"count": 30
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ext": ".stringsdata",
|
|
||||||
"count": 28
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ext": ".o",
|
|
||||||
"count": 26
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ext": ".swift",
|
|
||||||
"count": 22
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"ext": ".modulemap",
|
|
||||||
"count": 8
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"tags": [
|
|
||||||
"transport"
|
|
||||||
],
|
|
||||||
"commits_list": [
|
|
||||||
{
|
|
||||||
"hash": "74aee8d",
|
|
||||||
"short": "fix(transport): URL-Konstruktion encoded ?-Query nicht mehr",
|
|
||||||
"type": "fix",
|
|
||||||
"scope": "transport",
|
|
||||||
"additions": 9,
|
|
||||||
"deletions": 1,
|
|
||||||
"timestamp": "2026-05-13T17:18:23+02:00"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"hash": "716509e",
|
|
||||||
"short": "v1.1.0 — Account-Lifecycle in ManaCore",
|
|
||||||
"type": null,
|
|
||||||
"scope": null,
|
|
||||||
"additions": 1226,
|
|
||||||
"deletions": 36,
|
|
||||||
"timestamp": "2026-05-13T19:22:19+02:00"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"hash": "3459c78",
|
|
||||||
"short": "v1.1.1 — Session-Token statt JWT für Account-Calls",
|
|
||||||
"type": null,
|
|
||||||
"scope": null,
|
|
||||||
"additions": 68,
|
|
||||||
"deletions": 16,
|
|
||||||
"timestamp": "2026-05-13T19:35:57+02:00"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"hash": "923b5d0",
|
|
||||||
"short": "v1.2.0 — Guest-Mode + Refresh-Resilience",
|
|
||||||
"type": null,
|
|
||||||
"scope": null,
|
|
||||||
"additions": 647,
|
|
||||||
"deletions": 160,
|
|
||||||
"timestamp": "2026-05-13T22:16:08+02:00"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"hash": "7526b80",
|
|
||||||
"short": "v1.3.0 — 2FA-Login-Challenge",
|
|
||||||
"type": null,
|
|
||||||
"scope": null,
|
|
||||||
"additions": 294,
|
|
||||||
"deletions": 0,
|
|
||||||
"timestamp": "2026-05-14T00:20:05+02:00"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"hash": "0a79083",
|
|
||||||
"short": "v1.4.0 — 2FA-Enrollment",
|
|
||||||
"type": null,
|
|
||||||
"scope": null,
|
|
||||||
"additions": 306,
|
|
||||||
"deletions": 0,
|
|
||||||
"timestamp": "2026-05-14T00:38:38+02:00"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"hash": "fe607c1",
|
|
||||||
"short": "v1.5.0 — getProfile() + ProfileInfo",
|
|
||||||
"type": null,
|
|
||||||
"scope": null,
|
|
||||||
"additions": 2876,
|
|
||||||
"deletions": 0,
|
|
||||||
"timestamp": "2026-05-14T01:06:50+02:00"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"hash": "216d9f8",
|
|
||||||
"short": "chore: untrack accidentally committed build/ + ignore",
|
|
||||||
"type": null,
|
|
||||||
"scope": null,
|
|
||||||
"additions": 1,
|
|
||||||
"deletions": 2682,
|
|
||||||
"timestamp": "2026-05-14T01:07:55+02:00"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"review_state": "auto",
|
|
||||||
"llm": {
|
|
||||||
"model": null,
|
|
||||||
"generated_at": null
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
@ -1,101 +0,0 @@
|
||||||
---
|
|
||||||
date: 2026-05-13
|
|
||||||
day: 2
|
|
||||||
view: macher
|
|
||||||
weekday: Mittwoch
|
|
||||||
commits: 8
|
|
||||||
review: written
|
|
||||||
---
|
|
||||||
# Mittwoch, 2026-05-13 — Tag 2 (Macher-Sicht)
|
|
||||||
|
|
||||||
Reifung von v1.0.0 zu v1.5.0 in einer Schicht. Sechs Sinn-Abschnitte
|
|
||||||
(Transport-Fix, Account-Lifecycle, Session-Token-Auth, Guest-Mode +
|
|
||||||
Refresh-Resilience, 2FA-Login, 2FA-Enrollment, Profile) plus ein
|
|
||||||
chore-Cleanup. Build-Verzeichnis war versehentlich committet — am
|
|
||||||
Ende des Tages aufgeräumt.
|
|
||||||
|
|
||||||
## Stats
|
|
||||||
|
|
||||||
8 Commits, +5 427 / −2 895 LoC, 408 Files. **Achtung: 2 682 der
|
|
||||||
Deletions kamen aus `chore: untrack build/`** — der eigentliche
|
|
||||||
Code-Delta ist eher +2 700 / −200. Top-Dirs sind irreführend (alle
|
|
||||||
`build/`-Sub-Dirs), weil der Initial-Push das build/ mit hatte.
|
|
||||||
Tags: `transport`. Session 15:18 → 01:08, 62 aktive Minuten in
|
|
||||||
4 Blöcken, längster Fokus 48 Min.
|
|
||||||
|
|
||||||
## Versions-Schritte
|
|
||||||
|
|
||||||
- **Transport-Fix** — URL-Konstruktion encoded `?`-Query nicht mehr.
|
|
||||||
Klassischer Bug: Path-Encoding lief gegen Query-String, dadurch
|
|
||||||
`?from=…` als `%3Ffrom%3D…` rausgeschickt. 9 / −1 Zeilen.
|
|
||||||
- **v1.1.0 — Account-Lifecycle.** Change-Email, Change-Password,
|
|
||||||
Account-Delete als public API in ManaCore. ViewModels in
|
|
||||||
mana-swift-ui ziehen morgen nach.
|
|
||||||
- **v1.1.1 — Session-Token statt JWT für Account-Calls.**
|
|
||||||
Account-Operationen sind sensibel, brauchen frischen
|
|
||||||
Re-Auth-Token, nicht den allgemeinen JWT.
|
|
||||||
- **v1.2.0 — Guest-Mode + Refresh-Resilience.** Wenn ein Refresh
|
|
||||||
mit transienten Errors fehlschlägt (Netz-Timeout, 503), bleibt
|
|
||||||
die Session aktiv und retried. Wenn der Refresh hart 401 macht,
|
|
||||||
fällt der State auf `.guest` zurück statt blind alle Tokens zu
|
|
||||||
wipen. **Das war der wichtigste Fix** — vorher hat mobiles Netz
|
|
||||||
Memoro-User regelmäßig rausgeworfen.
|
|
||||||
- **v1.3.0 — 2FA-Login-Challenge.** Wenn Login `requires_2fa: true`
|
|
||||||
zurückgibt, dann zweiter Round-Trip mit Code.
|
|
||||||
- **v1.4.0 — 2FA-Enrollment.** Enroll-Init (QR-Secret) + Enroll-
|
|
||||||
Verify + Disable mit Passwort + Backup-Code-Regenerate.
|
|
||||||
- **v1.5.0 — getProfile() + ProfileInfo.** Name, E-Mail,
|
|
||||||
Mitgliedsstatus, Tier. +2 876 LoC — viel davon vendored swift-
|
|
||||||
jose-Updates, die für RS256-JWKS-Verify nötig waren.
|
|
||||||
- **chore: untrack build/** — `.gitignore` für `build/`, vorhandene
|
|
||||||
Tracked-Files raus.
|
|
||||||
|
|
||||||
## Architektur-Entscheidungen
|
|
||||||
|
|
||||||
- **Session-Token (kurze TTL) für Account-Calls**, nicht der
|
|
||||||
allgemeine JWT. Begründung: bei Account-Delete oder Email-Change
|
|
||||||
wäre ein gestohlener JWT katastrophal; frischer Session-Token
|
|
||||||
begrenzt das Schaden-Fenster.
|
|
||||||
- **Refresh-Resilience: transient vs. permanent.** Transiente
|
|
||||||
Errors (Netz, 503, Timeout) halten Session, retry mit Backoff.
|
|
||||||
Permanente Errors (401, invalid_grant) führen zu `.guest`.
|
|
||||||
Vorher: jede Refresh-Failure → Wipe.
|
|
||||||
- **Guest-Mode als eigener State**, nicht „signed-out". Apps
|
|
||||||
können Inhalt anzeigen, der Read-Only ist, ohne dass sie eine
|
|
||||||
Login-Wand zeigen müssen.
|
|
||||||
- **2FA-API additiv**, kein Breaking-Change. Apps, die kein 2FA
|
|
||||||
unterstützen, ignorieren `requires_2fa`-Field.
|
|
||||||
- **ProfileInfo als eigenes DTO**, nicht in AuthClient verbaut.
|
|
||||||
Profile ist datenzentriert, AuthClient ist State-zentriert.
|
|
||||||
- **swift-jose vendored**, statt SPM-Dependency. Public-API-
|
|
||||||
Invariante „keine externen Dependencies" (Compliance-Direktive)
|
|
||||||
bleibt.
|
|
||||||
|
|
||||||
## Trade-offs
|
|
||||||
|
|
||||||
- **+2 876 LoC für v1.5.0** klingt monströs, ist aber zu 80 %
|
|
||||||
vendored swift-jose. Eigentliche Profile-API ist klein.
|
|
||||||
- **Sechs Tags an einem Tag** ist viel — bei strikter Semver wäre
|
|
||||||
das eine Tagesserie, kein Sprint. Akzeptiert, weil jeder Tag
|
|
||||||
einen klar abgegrenzten Sinn-Abschnitt hat.
|
|
||||||
- **build/-Verzeichnis untracken nachträglich** war Aufwand
|
|
||||||
(2 682 deletions in einem Commit). Ursache: SwiftPM-CLI legt
|
|
||||||
build/ im Repo-Root an, statt unter DerivedData — `.gitignore`
|
|
||||||
hätte Tag 1 schon gehört.
|
|
||||||
- **Session-Token-Mechanik** in v1.1.1 nachgeschoben, weil
|
|
||||||
v1.1.0 das nicht hatte. Hätte v1.1.0 direkt richtig machen
|
|
||||||
sollen; akzeptiert als „erste Lernzyklen".
|
|
||||||
|
|
||||||
## Offene Punkte
|
|
||||||
|
|
||||||
- **Refresh-Resilience Test-Coverage**: Unit-Tests für transiente
|
|
||||||
vs. permanente Fehler-Pfade existieren, aber kein
|
|
||||||
Real-World-Test (instabiles Netz simulieren).
|
|
||||||
- **2FA-Backup-Codes-Storage**: ManaCore liefert sie als Strings
|
|
||||||
zurück; UI muss sie sicher anzeigen + kopierbar machen. Liegt
|
|
||||||
bei mana-swift-ui.
|
|
||||||
- **getProfile() Cache-Politik**: derzeit kein Cache. Bei häufigen
|
|
||||||
Calls hilft eine kurze TTL.
|
|
||||||
- **Schema-Drift gegen mana-auth**: wenn der Server `ProfileInfo`-
|
|
||||||
Schema ändert, gibt's keinen Wire-Check. Pre-Live-Smoke wäre
|
|
||||||
sinnvoll.
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
---
|
|
||||||
date: 2026-05-13
|
|
||||||
day: 2
|
|
||||||
view: spieler
|
|
||||||
weekday: Mittwoch
|
|
||||||
commits: 8
|
|
||||||
review: written
|
|
||||||
---
|
|
||||||
# Mittwoch, 2026-05-13 — Tag 2
|
|
||||||
|
|
||||||
Großer Tag für die Vereins-App-Grundlagen. Was alle Vereins-Apps
|
|
||||||
gemeinsam haben — Anmelden, Konto-Verwalten, Profil-Anzeigen — ist
|
|
||||||
heute stabiler und reicher geworden. Im Hintergrund.
|
|
||||||
|
|
||||||
## Was sich für dich in den Apps ändert
|
|
||||||
|
|
||||||
- **Du bleibst eingeloggt, auch wenn das Netz mal schwächelt.**
|
|
||||||
Vorher hat eine wackelige Verbindung manchmal den Login
|
|
||||||
rausgeworfen — neu hält die App durch und versucht es nochmal.
|
|
||||||
- **Gast-Modus** ist sauber möglich: Du kannst dir eine App ansehen,
|
|
||||||
bevor du dich anmeldest, ohne dass die App dich abwirft.
|
|
||||||
- **Konto-Aktionen funktionieren überall gleich** — E-Mail ändern,
|
|
||||||
Passwort wechseln, Konto löschen.
|
|
||||||
- **Zwei-Faktor-Schutz** ist nun durchgängig möglich (Login mit Code,
|
|
||||||
Einrichten in den Einstellungen).
|
|
||||||
- **Dein Profil** (Name, E-Mail, Mitgliedsstatus) kann von Apps
|
|
||||||
einheitlich angefragt werden.
|
|
||||||
|
|
||||||
## Hintergrund
|
|
||||||
|
|
||||||
Diese Sachen baut sonst jede App neu — mit kleinen Unterschieden, die
|
|
||||||
Menschen verwirren. Heute lagen sie an einem Ort, getestet, dokumentiert,
|
|
||||||
versioniert.
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue