feat: secure adult content access and refresh project identity

Author: LamPPKK

.github/workflows/contract-sync-android.yml

@@ -19,7 +19,7 @@ jobs:
     timeout-minutes: 10
     env:
       GH_TOKEN: ${{ secrets.ANDROID_CONTRACT_SYNC_TOKEN }}
-      ANDROID_REPOSITORY: LamPPKK/Android.Smart.Movie
+      ANDROID_REPOSITORY: LamPPKK/Smart-Movie-Android
     steps:
       - uses: actions/checkout@v7
 
@@ -66,7 +66,7 @@ jobs:
           snapshot = {
               "schema_version": 1,
               "contract_version": canonical["contract_version"],
-              "upstream_repository": "LamPPKK/SmartMovie",
+              "upstream_repository": "LamPPKK/Smart-Movie-iOS",
               "upstream_commit": commit,
               "openapi_sha256": canonical["openapi_sha256"],
               "fixtures_sha256": canonical["fixtures_sha256"],
@@ -99,5 +99,5 @@ jobs:
               --base main \
               --head "$branch" \
               --title "chore: sync SmartMovie catalog contract" \
-              --body "Automated snapshot of the canonical catalog contract from LamPPKK/SmartMovie@$GITHUB_SHA. Merge only after Android and desktop conformance CI passes."
+              --body "Automated snapshot of the canonical catalog contract from LamPPKK/Smart-Movie-iOS@$GITHUB_SHA. Merge only after Android and desktop conformance CI passes."
           fi

.github/workflows/worker.yml

@@ -139,8 +139,8 @@ jobs:
       - name: Require Android main to pin this contract
         working-directory: ${{ github.workspace }}
         env:
-          ANDROID_CONTRACT_MANIFEST: https://raw.githubusercontent.com/LamPPKK/Android.Smart.Movie/main/catalog-contract/manifest.json
-          ANDROID_RELEASE_MANIFEST: https://raw.githubusercontent.com/LamPPKK/Android.Smart.Movie/main/release/train.json
+          ANDROID_CONTRACT_MANIFEST: https://raw.githubusercontent.com/LamPPKK/Smart-Movie-Android/main/catalog-contract/manifest.json
+          ANDROID_RELEASE_MANIFEST: https://raw.githubusercontent.com/LamPPKK/Smart-Movie-Android/main/release/train.json
         run: |
           set -euo pipefail
           local_checksum="$(node -e 'const fs=require("node:fs"); console.log(JSON.parse(fs.readFileSync("backend/worker/contract/v2/manifest.json", "utf8")).openapi_sha256)')"

README.md

@@ -1,9 +1,9 @@
-# SmartMovie 3.0 — Apple apps and TMDb catalog backend
+# Smart Movie iOS 3.0 — Apple apps and TMDb catalog backend
 
-[![Swift](https://github.com/LamPPKK/SmartMovie/actions/workflows/swift.yml/badge.svg?branch=main)](https://github.com/LamPPKK/SmartMovie/actions/workflows/swift.yml)
-[![Xcode build and analyze](https://github.com/LamPPKK/SmartMovie/actions/workflows/xcode-build-analyze.yml/badge.svg?branch=main)](https://github.com/LamPPKK/SmartMovie/actions/workflows/xcode-build-analyze.yml)
-[![iOS smoke test](https://github.com/LamPPKK/SmartMovie/actions/workflows/ios.yml/badge.svg?branch=main)](https://github.com/LamPPKK/SmartMovie/actions/workflows/ios.yml)
-[![Catalog Worker](https://github.com/LamPPKK/SmartMovie/actions/workflows/worker.yml/badge.svg?branch=main)](https://github.com/LamPPKK/SmartMovie/actions/workflows/worker.yml)
+[![Swift](https://github.com/LamPPKK/Smart-Movie-iOS/actions/workflows/swift.yml/badge.svg?branch=main)](https://github.com/LamPPKK/Smart-Movie-iOS/actions/workflows/swift.yml)
+[![Xcode build and analyze](https://github.com/LamPPKK/Smart-Movie-iOS/actions/workflows/xcode-build-analyze.yml/badge.svg?branch=main)](https://github.com/LamPPKK/Smart-Movie-iOS/actions/workflows/xcode-build-analyze.yml)
+[![iOS smoke test](https://github.com/LamPPKK/Smart-Movie-iOS/actions/workflows/ios.yml/badge.svg?branch=main)](https://github.com/LamPPKK/Smart-Movie-iOS/actions/workflows/ios.yml)
+[![Catalog Worker](https://github.com/LamPPKK/Smart-Movie-iOS/actions/workflows/worker.yml/badge.svg?branch=main)](https://github.com/LamPPKK/Smart-Movie-iOS/actions/workflows/worker.yml)
 
 SmartMovie is a cinematic TMDb catalog for the Apple ecosystem. It covers movies, television, people, collections, companies, networks, keywords, seasons, and episodes; adds region-aware availability and trailers; and can optionally synchronize library, ratings, recommendations, and mixed lists through a browser-approved TMDb account.
 
@@ -19,8 +19,8 @@ This repository contains the native SwiftUI apps for iPhone, iPad, Mac Catalyst,
 
 | Repository | Owns | Mobile release role |
 | --- | --- | --- |
-| **[SmartMovie](https://github.com/LamPPKK/SmartMovie)** (this repository) | SwiftUI Apple apps, `SmartMovieKit`, Cloudflare Worker, OpenAPI 3.1 contract, canonical fixtures | App Store source of truth and backend owner |
-| **[Android.Smart.Movie](https://github.com/LamPPKK/Android.Smart.Movie)** | Native Android and Wear OS apps, Compose Multiplatform desktop/web app, versioned contract snapshot | Google Play source of truth |
+| **[Smart Movie iOS](https://github.com/LamPPKK/Smart-Movie-iOS)** (this repository) | SwiftUI Apple apps, `SmartMovieKit`, Cloudflare Worker, OpenAPI 3.1 contract, canonical fixtures | App Store source of truth and backend owner |
+| **[Smart Movie Android](https://github.com/LamPPKK/Smart-Movie-Android)** | Native Android and Wear OS apps, Compose Multiplatform desktop/web app, versioned contract snapshot | Google Play source of truth |
 
 The two native mobile apps keep platform-specific UI and storage while sharing the additive `/v2` Worker contract, six locales, semantic release train, normalized errors, and deterministic decoder fixtures. `/v1` remains served for SmartMovie 2.0 compatibility. Account identity and content belong to TMDb; SmartMovie only brokers opaque sessions and maintains local-first caches/outboxes.
 
@@ -161,8 +161,8 @@ sudo xcode-select --switch /Applications/Xcode.app/Contents/Developer
 Clone, generate, and open the project:
 
 ```sh
-git clone https://github.com/LamPPKK/SmartMovie.git
-cd SmartMovie
+git clone https://github.com/LamPPKK/Smart-Movie-iOS.git
+cd Smart-Movie-iOS
 xcodegen generate --spec SmartMovie/project.yml
 open SmartMovie/SmartMovie.xcodeproj
 ```
@@ -202,7 +202,7 @@ cd ../..
 ./scripts/verify-release.sh
 ```
 
-The current verified local baseline contains 57 Swift tests and 91 Worker tests. Coverage includes canonical `/v1` and `/v2` fixture decoding, configured capability/fixture equality, fail-closed browser/TV account rollout, malformed broker configuration and return-URI allowlists, cold-start callback deferral, stale completion invalidation, durable outbox isolation, capability-gated Advanced Discover and Profile provider regions with a fail-closed `/v1` fallback, complete Movie/TV Discover queries and regional provider configuration, External ID and Credit Detail source/path mapping, account recommendations, normalized/paginated custom mixed lists, restart-safe pending item snapshots, local adult filtering and in-flight request invalidation, metadata/item mutations, normalized person/title credit links, unknown and missing nullable fields, success/error schema validation, repeatable D1 migrations, encryption/callback/CSRF controls, durable idempotency, TMDb Changes pagination/backlog recovery, invalid cursor recovery, verified changing-page-count fallback, D1 parameter-bound chunking, monotonic revision and cache-bypass behavior, retries, cancellation, pagination, and data behavior without live personal credentials.
+The current verified local baseline contains 60 Swift tests and 91 Worker tests. Coverage includes canonical `/v1` and `/v2` fixture decoding, configured capability/fixture equality, fail-closed browser/TV account rollout, malformed broker configuration and return-URI allowlists, cold-start callback deferral, stale completion invalidation, durable outbox isolation, capability-gated Advanced Discover and Profile provider regions with a fail-closed `/v1` fallback, complete Movie/TV Discover queries and regional provider configuration, External ID and Credit Detail source/path mapping, account recommendations, normalized/paginated custom mixed lists, restart-safe pending item snapshots, explicit adult age confirmation, six-digit PIN validation, five-attempt lockout, local adult filtering and in-flight request invalidation, metadata/item mutations, normalized person/title credit links, unknown and missing nullable fields, success/error schema validation, repeatable D1 migrations, encryption/callback/CSRF controls, durable idempotency, TMDb Changes pagination/backlog recovery, invalid cursor recovery, verified changing-page-count fallback, D1 parameter-bound chunking, monotonic revision and cache-bypass behavior, retries, cancellation, pagination, and data behavior without live personal credentials.
 
 CI independently builds and analyzes iOS, iPad/Catalyst, tvOS, native macOS, watchOS, and visionOS, then installs and launches the iOS app in Simulator. Read [Testing](docs/TESTING.md) for destination-specific commands and the manual device matrix.
 

SmartMovieKit/Sources/SmartMovieKit/App/AccountSession.swift

@@ -167,7 +167,11 @@ public final class AdultContentController {
     public var includeAdult: Bool { isEnabled && isUnlocked && !isLocked }
     public var isLocked: Bool { lockUntil.map { $0 > now() } ?? false }
 
-    public func configure(pin: String, confirmation: String) -> Bool {
+    public func configure(pin: String, confirmation: String, ageConfirmed: Bool) -> Bool {
+        guard ageConfirmed else {
+            errorMessage = String(localized: "Confirm that you are at least 18 years old.", bundle: .module)
+            return false
+        }
         guard pin == confirmation, pin.range(of: #"^[0-9]{6}$"#, options: .regularExpression) != nil else {
             errorMessage = String(localized: "Enter the same six-digit PIN twice.", bundle: .module)
             return false

SmartMovieKit/Sources/SmartMovieKit/App/FeatureModels.swift

@@ -20,9 +20,7 @@ public final class ExploreViewModel {
     private var configurationTask: Task<Void, Never>?
     private var requestID = UUID()
     private var configurationRequestID = UUID()
-    public init(catalog: any CatalogRepository) {
-        self.catalog = catalog
-    }
+    public init(catalog: any CatalogRepository) { self.catalog = catalog }
 
     public var providers: [WatchProviderOption] {
         configuration?.watchProviders?.values(for: mediaType) ?? []
@@ -264,10 +262,7 @@ public final class SearchViewModel {
     public var externalIDSource: ExternalIDSource = .imdb
     public private(set) var entities: [CatalogEntity] = []
     public var items: [TitleSummary] {
-        entities.compactMap { entity in
-            if case .title(let title) = entity { return title }
-            return nil
-        }
+        entities.compactMap { if case .title(let title) = $0 { title } else { nil } }
     }
     public private(set) var isLoading = false
     public private(set) var errorMessage: String?
@@ -276,6 +271,8 @@ public final class SearchViewModel {
     private let catalog: any CatalogRepository
     private var page = 0
     private var searchTask: Task<Void, Never>?
+    private var searchGeneration = 0
+    private var includeAdult = false
 
     public init(catalog: any CatalogRepository) {
         self.catalog = catalog
@@ -284,6 +281,7 @@ public final class SearchViewModel {
     public func setMode(_ mode: CatalogSearchMode) {
         guard self.mode != mode else { return }
         searchTask?.cancel()
+        searchGeneration += 1
         self.mode = mode
         query = ""
         entities = []
@@ -297,6 +295,7 @@ public final class SearchViewModel {
     public func resetExternalIDResults() {
         guard mode == .externalID else { return }
         searchTask?.cancel()
+        searchGeneration += 1
         entities = []
         errorMessage = nil
         isLoading = false
@@ -305,6 +304,8 @@ public final class SearchViewModel {
 
     public func scheduleSearch(language: String, region: String? = nil, includeAdult: Bool = false) {
         searchTask?.cancel()
+        searchGeneration += 1
+        self.includeAdult = includeAdult
         guard mode == .catalog else { return }
         let trimmed = query.trimmingCharacters(in: .whitespacesAndNewlines)
         guard !trimmed.isEmpty else {
@@ -317,6 +318,7 @@ public final class SearchViewModel {
         let expectedQuery = trimmed
         let expectedScope = scope
         let expectedEntityScope = entityScope
+        let expectedGeneration = searchGeneration
         searchTask = Task { [weak self, catalog] in
             do {
                 try await Task.sleep(for: .milliseconds(350))
@@ -349,6 +351,8 @@ public final class SearchViewModel {
                     )
                 }
                 guard !Task.isCancelled,
+                      searchGeneration == expectedGeneration,
+                      self.includeAdult == includeAdult,
                       query.trimmingCharacters(in: .whitespacesAndNewlines) == expectedQuery,
                       scope == expectedScope,
                       entityScope == expectedEntityScope else { return }
@@ -365,8 +369,10 @@ public final class SearchViewModel {
         }
     }
 
-    public func findExternalID(language: String) {
+    public func findExternalID(language: String, includeAdult: Bool = false) {
         searchTask?.cancel()
+        searchGeneration += 1
+        self.includeAdult = includeAdult
         let externalID = query.trimmingCharacters(in: .whitespacesAndNewlines)
         guard mode == .externalID, !externalID.isEmpty else {
             entities = []
@@ -376,6 +382,7 @@ public final class SearchViewModel {
         }
         hasSubmittedExternalID = true
         let expectedSource = externalIDSource
+        let expectedGeneration = searchGeneration
         searchTask = Task { [weak self, catalog] in
             guard let self else { return }
             isLoading = true
@@ -389,10 +396,12 @@ public final class SearchViewModel {
                     language: language
                 )
                 guard !Task.isCancelled,
+                      searchGeneration == expectedGeneration,
+                      self.includeAdult == includeAdult,
                       mode == .externalID,
                       query.trimmingCharacters(in: .whitespacesAndNewlines) == externalID,
                       externalIDSource == expectedSource else { return }
-                entities = result.results
+                entities = result.results.filter { includeAdult || !$0.isAdultTitle }
                 isLoading = false
             } catch is CancellationError {
                 return
@@ -427,10 +436,10 @@ public final class SearchViewModel {
         let expectedScope = scope
         let expectedEntityScope = entityScope
         let nextPage = page + 1
+        let expectedGeneration = searchGeneration
         isLoading = true
-        Task { [weak self, catalog] in
+        searchTask = Task { [weak self, catalog] in
             guard let self else { return }
-            defer { isLoading = false }
             do {
                 let result: PagedResult<CatalogEntity>
                 if let catalogV2 = catalog as? any CatalogV2Repository {
@@ -457,17 +466,35 @@ public final class SearchViewModel {
                         results: legacy.results.map(CatalogEntity.title)
                     )
                 }
-                guard query.trimmingCharacters(in: .whitespacesAndNewlines) == expectedQuery,
+                guard !Task.isCancelled,
+                      searchGeneration == expectedGeneration,
+                      self.includeAdult == includeAdult,
+                      query.trimmingCharacters(in: .whitespacesAndNewlines) == expectedQuery,
                       scope == expectedScope,
                       entityScope == expectedEntityScope else { return }
                 entities.append(contentsOf: result.results.filter { incoming in
                     !entities.contains(where: { $0.id == incoming.id })
                 })
                 page = result.page
                 canLoadMore = result.page < result.totalPages
+                isLoading = false
+            } catch is CancellationError {
+                return
             } catch {
+                guard searchGeneration == expectedGeneration else { return }
+                isLoading = false
                 errorMessage = error.localizedDescription
             }
         }
     }
+
+    public func applyAdultVisibility(includeAdult: Bool) {
+        self.includeAdult = includeAdult
+        guard !includeAdult else { return }
+        searchTask?.cancel()
+        searchGeneration += 1
+        entities.removeAll(where: \.isAdultTitle)
+        isLoading = false
+        canLoadMore = false
+    }
 }

SmartMovieKit/Sources/SmartMovieKit/Domain/CatalogEntity+Adult.swift

@@ -0,0 +1,6 @@
+extension CatalogEntity {
+    var isAdultTitle: Bool {
+        if case .title(let title) = self { return title.isAdult }
+        return false
+    }
+}

SmartMovieKit/Sources/SmartMovieKit/Resources/en.lproj/Localizable.strings

@@ -133,3 +133,19 @@
 "Provider region" = "Provider region";
 "Watch providers" = "Watch providers";
 "TMDb account is temporarily unavailable." = "TMDb account is temporarily unavailable.";
+"Adult content" = "Adult content";
+"Off by default. Confirm you are at least 18 and create a six-digit PIN stored only on this device. Adult titles never appear on Watch/Wear remote or public previews." = "Off by default. Confirm you are at least 18 and create a six-digit PIN stored only on this device. Adult titles never appear on Watch/Wear remote or public previews.";
+"I confirm that I am at least 18 years old." = "I confirm that I am at least 18 years old.";
+"Confirm that you are at least 18 years old." = "Confirm that you are at least 18 years old.";
+"Six-digit PIN" = "Six-digit PIN";
+"Confirm PIN" = "Confirm PIN";
+"Enable adult content" = "Enable adult content";
+"Unlocked on this device" = "Unlocked on this device";
+"Lock" = "Lock";
+"Disable" = "Disable";
+"Enter PIN" = "Enter PIN";
+"Unlock" = "Unlock";
+"Enter the same six-digit PIN twice." = "Enter the same six-digit PIN twice.";
+"Incorrect PIN." = "Incorrect PIN.";
+"Too many attempts. Try again in five minutes." = "Too many attempts. Try again in five minutes.";
+"Source repositories" = "Source repositories";

SmartMovieKit/Sources/SmartMovieKit/Resources/ja.lproj/Localizable.strings

@@ -133,3 +133,19 @@
 "Provider region" = "配信地域";
 "Watch providers" = "視聴サービス";
 "TMDb account is temporarily unavailable." = "TMDbアカウントは一時的に利用できません。";
+"Adult content" = "成人向けコンテンツ";
+"Off by default. Confirm you are at least 18 and create a six-digit PIN stored only on this device. Adult titles never appear on Watch/Wear remote or public previews." = "初期設定はオフです。18歳以上であることを確認し、この端末だけに保存する6桁PINを作成してください。成人向け作品はWatch/Wearリモートや公開プレビューには表示されません。";
+"I confirm that I am at least 18 years old." = "18歳以上であることを確認します。";
+"Confirm that you are at least 18 years old." = "18歳以上であることを確認してください。";
+"Six-digit PIN" = "6桁PIN";
+"Confirm PIN" = "PINを確認";
+"Enable adult content" = "成人向けを有効化";
+"Unlocked on this device" = "この端末でロック解除済み";
+"Lock" = "ロック";
+"Disable" = "無効化";
+"Enter PIN" = "PINを入力";
+"Unlock" = "ロック解除";
+"Enter the same six-digit PIN twice." = "同じ6桁PINを2回入力してください。";
+"Incorrect PIN." = "PINが正しくありません。";
+"Too many attempts. Try again in five minutes." = "試行回数を超えました。5分後に再試行してください。";
+"Source repositories" = "ソースリポジトリ";