feat: authorize iOS Hermes accounts and secure session isolation

Sources/Networking/AuthClient.swift

@@ -0,0 +1,77 @@
+import Foundation
+
+struct AuthUser: Codable, Equatable {
+    let id: String
+    let username: String
+    let displayName: String?
+    let role: String
+    let status: String
+    enum CodingKeys: String, CodingKey {
+        case id, username, role, status
+        case displayName = "display_name"
+    }
+}
+struct AuthLoginResponse: Decodable {
+    let token: String
+    let user: AuthUser
+    let expiresAt: Double
+    enum CodingKeys: String, CodingKey {
+        case token, user
+        case expiresAt = "expires_at"
+    }
+    init(from decoder: Decoder) throws {
+        let c = try decoder.container(keyedBy: CodingKeys.self)
+        token = try c.decode(String.self, forKey: .token)
+        user = try c.decode(AuthUser.self, forKey: .user)
+        if let seconds = try? c.decode(Double.self, forKey: .expiresAt) { expiresAt = seconds }
+        else {
+            let raw = try c.decode(String.self, forKey: .expiresAt)
+            guard let date = ISO8601DateFormatter().date(from: raw) else { throw AuthError.invalidResponse }
+            expiresAt = date.timeIntervalSince1970
+        }
+    }
+
+}
+enum AuthError: LocalizedError {
+    case status(Int)
+    case invalidResponse
+    var errorDescription: String? {
+        switch self {
+        case .status(401): return "Your sign-in expired or the username and password were not accepted. Sign in again."
+        case .status(403): return "This account is not authorized. Contact your server administrator."
+        case .status: return "The server could not complete sign-in. Try again later."
+        case .invalidResponse: return "The server returned an unexpected authentication response."
+        }
+    }
+}
+final class AuthClient {
+    let config: ServerConfig
+    private let session: URLSession
+    init(config: ServerConfig, session: URLSession? = nil) {
+        self.config = config
+        self.session = session ?? TLSPinning.session()
+    }
+    private func request(_ path: String, method: String, token: String? = nil, body: Data? = nil) async throws -> Data {
+        var request = URLRequest(url: config.baseURL.appendingPathComponent(path))
+        request.httpMethod = method
+        request.timeoutInterval = 10
+        request.httpBody = body
+        if body != nil { request.setValue("application/json", forHTTPHeaderField: "Content-Type") }
+        if let token { request.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization") }
+        let (data, response) = try await session.data(for: request)
+        guard let http = response as? HTTPURLResponse else { throw AuthError.invalidResponse }
+        guard (200..<300).contains(http.statusCode) else { throw AuthError.status(http.statusCode) }
+        return data
+    }
+    func login(username: String, password: String) async throws -> AuthLoginResponse {
+        let body = try JSONSerialization.data(withJSONObject: ["username": username, "password": password])
+        return try JSONDecoder().decode(AuthLoginResponse.self, from: await request("api/auth/login", method: "POST", body: body))
+    }
+    func me(token: String) async throws -> AuthUser {
+        struct Response: Decodable { let user: AuthUser }
+        return try JSONDecoder().decode(Response.self, from: await request("api/auth/me", method: "GET", token: token)).user
+    }
+    func logout(token: String) async throws {
+        _ = try await request("api/auth/logout", method: "POST", token: token)
+    }
+}

Sources/Networking/KeychainTokenStore.swift

@@ -0,0 +1,43 @@
+import Foundation
+import Security
+
+protocol TokenStore {
+    func token(origin: String) throws -> String?
+    func save(_ token: String?, origin: String) throws
+}
+struct KeychainTokenStore: TokenStore {
+    private func query(_ origin: String) -> [String: Any] {
+        [kSecClass as String: kSecClassGenericPassword,
+         kSecAttrService as String: "dev.shane.voice.auth",
+         kSecAttrAccount as String: origin]
+    }
+    func token(origin: String) throws -> String? {
+        var q = query(origin)
+        q[kSecReturnData as String] = true
+        q[kSecMatchLimit as String] = kSecMatchLimitOne
+        var result: CFTypeRef?
+        let status = SecItemCopyMatching(q as CFDictionary, &result)
+        if status == errSecItemNotFound { return nil }
+        guard status == errSecSuccess, let data = result as? Data else { throw StoreError.failed }
+        return String(data: data, encoding: .utf8)
+    }
+    func save(_ token: String?, origin: String) throws {
+        let q = query(origin)
+        let deletion = SecItemDelete(q as CFDictionary)
+        guard deletion == errSecSuccess || deletion == errSecItemNotFound else { throw StoreError.failed }
+        guard let token else { return }
+        var item = q
+        item[kSecValueData as String] = Data(token.utf8)
+        item[kSecAttrAccessible as String] = kSecAttrAccessibleWhenUnlockedThisDeviceOnly
+        guard SecItemAdd(item as CFDictionary, nil) == errSecSuccess else { throw StoreError.failed }
+    }
+    enum StoreError: LocalizedError {
+        case failed
+        var errorDescription: String? { "Could not securely save the sign-in on this iPhone." }
+    }
+}
+final class MemoryTokenStore: TokenStore {
+    private var values: [String: String] = [:]
+    func token(origin: String) throws -> String? { values[origin] }
+    func save(_ token: String?, origin: String) throws { values[origin] = token }
+}

Sources/Networking/ServerConfig.swift

@@ -29,19 +29,19 @@ struct ServerConfig: Equatable {
             return .failure(.invalidURL(raw))
         }
         if scheme != "https" { return .failure(.notHTTPS(raw)) }
-        var c = components
-        c.path = ""
-        c.fragment = nil
-        guard let base = c.url else { return .failure(.invalidURL(raw)) }
-        // LAN deployment: LiveKit is reachable directly on :7880 (plain ws).
-        // Real domains use wss via same origin. The SDK derives /rtc from the base.
-        let livekit: URL
-        if Self.isPrivateIP(host) {
-            livekit = URL(string: "ws://\(host):7880")!
-        } else {
-            let portSuffix = components.port.map { ":\($0)" } ?? ""
-            livekit = URL(string: "wss://\(host)\(portSuffix)/livekit")!
+        guard components.user == nil, components.password == nil,
+              components.query == nil, components.fragment == nil else {
+            return .failure(.invalidURL(raw))
         }
+        var c = components
+        c.scheme = "https"
+        c.host = host.lowercased()
+        if c.port == 443 { c.port = nil }
+        c.path = ""
+        guard let base = c.url else { return .failure(.invalidURL(raw)) }
+        c.scheme = "wss"
+        c.path = "/livekit"
+        guard let livekit = c.url else { return .failure(.invalidURL(raw)) }
         return .success(ServerConfig(baseURL: base, livekitURL: livekit))
     }
 

Sources/Networking/TLSPinning.swift

@@ -15,7 +15,10 @@ enum TLSPinning {
     static let host = "192.168.86.2"
 
     static func session() -> URLSession {
-        let config = URLSessionConfiguration.default
+        let config = URLSessionConfiguration.ephemeral
+        config.urlCache = nil
+        config.httpCookieStorage = nil
+        config.urlCredentialStorage = nil
         config.timeoutIntervalForRequest = 15
         return URLSession(configuration: config, delegate: PinnedTrustDelegate(), delegateQueue: nil)
     }
@@ -37,7 +40,12 @@ enum TLSPinning {
     }
 }
 
-final class PinnedTrustDelegate: NSObject, URLSessionDelegate {
+final class PinnedTrustDelegate: NSObject, URLSessionDelegate, URLSessionTaskDelegate {
+    func urlSession(_ session: URLSession, task: URLSessionTask, willPerformHTTPRedirection response: HTTPURLResponse, newRequest request: URLRequest, completionHandler: @escaping (URLRequest?) -> Void) {
+        // Authentication/password-bearing requests must never be redirected to
+        // another endpoint or origin. Correct the configured server instead.
+        completionHandler(nil)
+    }
     func urlSession(_ session: URLSession, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
         guard challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust,
               let trust = challenge.protectionSpace.serverTrust else {

Sources/Networking/TokenClient.swift

@@ -42,22 +42,36 @@ enum TokenError: LocalizedError {
 final class TokenClient {
     let config: ServerConfig
     private let session: URLSession
+    var onUnauthorized: (() async -> Void)?
+    let bearerToken: String
 
-    init(config: ServerConfig) {
+    init(config: ServerConfig, bearerToken: String = "", session: URLSession? = nil) {
         self.config = config
-        self.session = TLSPinning.session()
+        self.session = session ?? TLSPinning.session()
+        self.bearerToken = bearerToken
     }
 
+    func cancel() { session.getAllTasks { $0.forEach { $0.cancel() } } }
+
     func fetchToken() async throws -> TokenResponse {
+        #if DEBUG
+        if ProcessInfo.processInfo.arguments.contains("--ui-testing"),
+           !ProcessInfo.processInfo.arguments.contains("--live-testing") {
+            throw URLError(.cannotConnectToHost) // offline fixtures never contact any configured server
+        }
+        #endif
+        guard !bearerToken.isEmpty else { throw AuthError.status(401) }
         var request = URLRequest(url: config.baseURL.appendingPathComponent("token"))
         request.httpMethod = "POST"
+        request.setValue("Bearer \(bearerToken)", forHTTPHeaderField: "Authorization")
         request.timeoutInterval = 10
         let (data, response) = try await session.data(for: request)
         guard let http = response as? HTTPURLResponse else {
             throw TokenError.decodeFailed
         }
         guard (200..<300).contains(http.statusCode) else {
-            let detail = String(data: data, encoding: .utf8) ?? ""
+            if http.statusCode == 401 || http.statusCode == 403 { await onUnauthorized?() }
+            let detail = ""
             throw TokenError.httpStatus(http.statusCode, detail)
         }
         do {