SOLIDPOD/SOLIDUI: throw exception when local secure storage not accessible in release builds
@jesscmoore is already working on this.
Since Oct 30, 2025.
- Dominant language
- Dart
- Stars
- 10
- Forks
- 7
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 6
Description
Describe the Bug
App builds (macos) in release mode without permission to access local secure storage cause users to not be able to login and store secure key on first time. They're able to login on second login button press, as this time data is accessed from runtime variable.
Mac app builds in release mode do not add the keychain access entitlement when not code signed with a Apple Developer Program certificate. We're using the recommended hardened runtime mode build setting which is recommended for macos, and locks down capabilities added with entitlements. As a resullt, unsigned mac app builds are not built with access to keychain (despite it being in the entitlement file) and therefore cannot save to local secure storage. However user still able to login on second login press.
flutter build macos --release --flavor unsigned
...
flutter: PlatformException(Unexpected security result code, Code: -34018, Message: A required entitlement isn't present., -34018, null)
To capture this platform dependent problem, we should fail the app when save to secure storage fails in unknown scenarios.
For macos unsigned builds, we could adjust to code to allow not saving in local secure storage, using perhaps the args dart package to capture the flutter CLI arguments, to see when being built in unsigned mode.
Some variation of this problem be happening on other platforms. Requires testing on physical devices (in release mode?) as running on simulators doesn't necessary replicate use of local device secure storage capabilities the same way.
To Reproduce
Steps to reproduce the behavior:
- Choose a solid based app, eg notepod
flutter build macos --release --flavor unsignedcd build/macos/Build/Products/Release-unsigned- Open
notepod.app -
- Click on 'Login' - user signs in but is then returned to and stuck in app login page
- Cick on 'Login' again - this time user is signed in because auth data in variable
- Same x 2 click required in press of Submit button after entering encryption secure key.
Expected Behaviour
App should fail gracefully with useful error message when it is unable to write to local secure storage.
Where we want to allow an exception, such as unsigned macos builds for testing, make this allowance.
Context
Where has the issue been observed:
- Android
- Chrome
- iOS
- Linux
- macOS
- Web
- Windows
Closing Criteria
Checklist for closing the issue:
-
make test -
make qtest - App fails with meaningful message when unable to use local secure storage when we are assuming it is.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.