anusii / anusii/solidpod

SOLIDPOD/SOLIDUI: throw exception when local secure storage not accessible in release builds

Open
#469 0 comments 0 reactions 1 assignee View on GitHub

@jesscmoore is already working on this.

Since Oct 30, 2025.

Dominant language
Dart
Stars
10
Forks
7
Avg merge
1d 3h
Merged PRs (30d)
6

Description

Describe the Bug

App builds (macos) in release mode without permission to access local secure storage cause users to not be able to login and store secure key on first time. They're able to login on second login button press, as this time data is accessed from runtime variable.

Mac app builds in release mode do not add the keychain access entitlement when not code signed with a Apple Developer Program certificate. We're using the recommended hardened runtime mode build setting which is recommended for macos, and locks down capabilities added with entitlements. As a resullt, unsigned mac app builds are not built with access to keychain (despite it being in the entitlement file) and therefore cannot save to local secure storage. However user still able to login on second login press.

flutter build macos --release --flavor unsigned
...
flutter: PlatformException(Unexpected security result code, Code: -34018, Message: A required entitlement isn't present., -34018, null)

To capture this platform dependent problem, we should fail the app when save to secure storage fails in unknown scenarios.

For macos unsigned builds, we could adjust to code to allow not saving in local secure storage, using perhaps the args dart package to capture the flutter CLI arguments, to see when being built in unsigned mode.

Some variation of this problem be happening on other platforms. Requires testing on physical devices (in release mode?) as running on simulators doesn't necessary replicate use of local device secure storage capabilities the same way.

To Reproduce

Steps to reproduce the behavior:

  1. Choose a solid based app, eg notepod
  2. flutter build macos --release --flavor unsigned
  3. cd build/macos/Build/Products/Release-unsigned
  4. Open notepod.app
    1. Click on 'Login' - user signs in but is then returned to and stuck in app login page
  5. Cick on 'Login' again - this time user is signed in because auth data in variable
  6. Same x 2 click required in press of Submit button after entering encryption secure key.

Expected Behaviour

App should fail gracefully with useful error message when it is unable to write to local secure storage.

Where we want to allow an exception, such as unsigned macos builds for testing, make this allowance.

Context

Where has the issue been observed:

  • Android
  • Chrome
  • iOS
  • Linux
  • macOS
  • Web
  • Windows

Closing Criteria

Checklist for closing the issue:

  • make test
  • make qtest
  • App fails with meaningful message when unable to use local secure storage when we are assuming it is.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.