fix(auth): defer keychain-sharing reconfigure during in-flight sign-in (#4231)

* fix(auth): defer keychain-sharing reconfigure during in-flight sign-in

When AWSCognitoAuthPlugin is configured with a shared keychain access
group, every fetchAuthSession unconditionally sent a .reconfigure event
to the auth state machine. If a fetchAuthSession landed between a
sign-in step that returned .confirmSignInWithCustomChallenge and the
caller's confirmSignIn, the reconfigure tore down the .signingIn
substate and the next confirmSignIn threw
AuthError.invalidState("User is not attempting signIn operation").

Replace the unconditional reconfigure with a reconcile that:

- Reads the shared keychain credentials, compares against the local
  state machine's authZ credentials, and skips reconfigure when they
  match — eliminating wasted reconfigures on every fetch.
- Defers reconfigure during locally-originated in-flight flows
  (.signingIn, .signingOut, .deletingUser, .federatingToIdentityPool,
  .clearingFederation) when the keychain has no signed-in credentials.
- Adopts a sibling app's sign-in by reconfiguring even during
  .signingIn when the remote keychain has user-pool tokens. Relax the
  AWSAuthConfirmSignInTask top-level guard to accept .signedIn and
  return .done so the pending confirmSignIn resolves cleanly.

Fixes #4224.

* refactor(auth): consolidate confirmSignIn state dispatch into a switch

Fold the .signedIn early-return into the same switch that handles
.signingIn dispatch. The listener loop already returns .done on
.signedIn(.sessionEstablished), so the early return was redundant —
the only thing the .signedIn branch needs to do is skip the event
dispatch that's specific to the .signingIn path.

* refactor(auth): inline .signedIn handling into analyzeCurrentStateAndCreateEvent and clarify keychain/state-machine fetch helper names

Move the .signedIn early-return for shared-keychain adoption into
analyzeCurrentStateAndCreateEvent so execute() has a single guard +
single dispatch. Rename fetchRemoteCredentials and the local-state
snapshot helper to fetchCredentialsFromKeychain and
fetchCredentialsFromStateMachine to make the source-of-truth pairing
explicit at the call site.

Author: harsh62

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/ClientBehavior/AWSCognitoAuthPlugin+ClientBehavior.swift

@@ -136,13 +136,13 @@ extension AWSCognitoAuthPlugin: AuthCategoryBehavior {
     public func fetchAuthSession(options: AuthFetchSessionRequest.Options?) async throws -> AuthSession {
         let options = options ?? AuthFetchSessionRequest.Options()
         let request = AuthFetchSessionRequest(options: options)
-        let forceReconfigure = secureStoragePreferences?.accessGroup?.name != nil
+        let isKeychainSharingEnabled = secureStoragePreferences?.accessGroup?.name != nil
         let task = AWSAuthFetchSessionTask(
             request,
             authStateMachine: authStateMachine,
             configuration: authConfiguration,
             environment: authEnvironment,
-            forceReconfigure: forceReconfigure
+            isKeychainSharingEnabled: isKeychainSharingEnabled
         )
         return try await taskQueue.sync {
             return try await task.value

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/CredentialStorage/AmplifyCredentials.swift

@@ -57,3 +57,14 @@ extension AmplifyCredentials: CustomDebugStringConvertible {
     }
 
 }
+
+extension AmplifyCredentials {
+    var hasUserPoolTokens: Bool {
+        switch self {
+        case .userPoolOnly, .userPoolAndIdentityPool:
+            return true
+        case .identityPoolOnly, .identityPoolWithFederation, .noCredentials:
+            return false
+        }
+    }
+}

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Task/AWSAuthConfirmSignInTask.swift

@@ -52,12 +52,11 @@ class AWSAuthConfirmSignInTask: AuthConfirmSignInTask, DefaultLogger {
             AuthPluginErrorConstants.invalidStateError, nil
         )
 
-        guard case .configured(let authNState, _, _) = await authStateMachine.currentState,
-              case .signingIn(let signInState) = authNState else {
+        guard case .configured(let authNState, _, _) = await authStateMachine.currentState else {
             throw invalidStateError
         }
 
-        try await analyzeCurrentStateAndCreateEvent(signInState, invalidStateError)
+        try await analyzeCurrentStateAndCreateEvent(authNState, invalidStateError)
 
         let stateSequences = await authStateMachine.listen()
         log.verbose("Waiting for response")
@@ -91,7 +90,19 @@ class AWSAuthConfirmSignInTask: AuthConfirmSignInTask, DefaultLogger {
         throw invalidStateError
     }
 
-    fileprivate func analyzeCurrentStateAndCreateEvent(_ signInState: SignInState, _ invalidStateError: AuthError) async throws {
+    fileprivate func analyzeCurrentStateAndCreateEvent(_ authNState: AuthenticationState, _ invalidStateError: AuthError) async throws {
+        // The shared keychain reconcile may have adopted a sibling app's
+        // sign-in while this flow was waiting for an answer. No event needs
+        // to be dispatched; the listener loop in execute() observes
+        // .signedIn and returns .done.
+        if case .signedIn = authNState {
+            return
+        }
+
+        guard case .signingIn(let signInState) = authNState else {
+            throw invalidStateError
+        }
+
         switch signInState {
         case .resolvingChallenge(let challengeState, let challengeType, _):
             // Validate if request valid MFA selection

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Task/AWSAuthFetchSessionTask.swift

@@ -7,14 +7,16 @@
 
 import Amplify
 import Foundation
+@_spi(KeychainStore) import AWSPluginsCore
 
 class AWSAuthFetchSessionTask: AuthFetchSessionTask, DefaultLogger {
     private let request: AuthFetchSessionRequest
     private let authStateMachine: AuthStateMachine
     private let fetchAuthSessionHelper: FetchAuthSessionOperationHelper
     private let taskHelper: AWSAuthTaskHelper
     private let configuration: AuthConfiguration
-    private let forceReconfigure: Bool
+    private let credentialsClient: CredentialStoreStateBehavior?
+    private let isKeychainSharingEnabled: Bool
 
     var eventName: HubPayloadEventName {
         HubPayload.EventName.Auth.fetchSessionAPI
@@ -25,30 +27,134 @@ class AWSAuthFetchSessionTask: AuthFetchSessionTask, DefaultLogger {
         authStateMachine: AuthStateMachine,
         configuration: AuthConfiguration,
         environment: Environment,
-        forceReconfigure: Bool = false
+        isKeychainSharingEnabled: Bool = false
     ) {
         self.request = request
         self.authStateMachine = authStateMachine
         self.fetchAuthSessionHelper = FetchAuthSessionOperationHelper()
         fetchAuthSessionHelper.environment = environment
         self.taskHelper = AWSAuthTaskHelper(authStateMachine: authStateMachine)
         self.configuration = configuration
-        self.forceReconfigure = forceReconfigure
+        self.credentialsClient = (environment as? AuthEnvironment)?.credentialsClient
+        self.isKeychainSharingEnabled = isKeychainSharingEnabled
     }
 
     func execute() async throws -> AuthSession {
         log.verbose("Starting execution")
-        if forceReconfigure {
-            log.verbose("Reconfiguring auth state machine for keychain sharing")
-            let event = AuthEvent(eventType: .reconfigure(configuration))
-            await authStateMachine.send(event)
-        }
         await taskHelper.didStateMachineConfigured()
+        if isKeychainSharingEnabled {
+            await reconcileWithSharedKeychainIfNeeded()
+        }
         let doesNeedForceRefresh = request.options.forceRefresh
         return try await fetchAuthSessionHelper.fetch(
             authStateMachine,
             forceRefresh: doesNeedForceRefresh
         )
     }
 
+    /// When the plugin is configured with a shared keychain access group, the
+    /// keychain is the source of truth across processes. Reconcile the local
+    /// state machine with whatever is currently in the keychain — but only
+    /// when doing so won't destroy locally-originated in-flight work.
+    ///
+    /// Decision matrix (auth state vs. remote-vs-local credentials):
+    /// - quiescent (.signedIn / .signedOut / .error / .configured / .notConfigured)
+    ///     - differ: reconfigure (sibling wrote — pick it up)
+    ///     - match: no-op
+    /// - .signingIn
+    ///     - remote has user-pool tokens: reconfigure (adopt sibling's sign-in;
+    ///       confirmSignIn will resolve to .done)
+    ///     - remote has no user-pool tokens: defer (sign-in flow finishes;
+    ///       last-writer-wins on the keychain)
+    /// - .signingOut / .deletingUser / .federatingToIdentityPool /
+    ///   .clearingFederation: defer (in-flight side effects must run; same end
+    ///   state is reached by the local flow)
+    func reconcileWithSharedKeychainIfNeeded() async {
+        guard let keychainCredentials = await fetchCredentialsFromKeychain() else {
+            return
+        }
+        guard case .configured(let authNState, let authZState, _) = await authStateMachine.currentState else {
+            return
+        }
+        let stateMachineCredentials = fetchCredentialsFromStateMachine(authZState)
+        if let stateMachineCredentials, stateMachineCredentials == keychainCredentials {
+            return
+        }
+
+        if shouldDeferReconcile(authNState: authNState, remote: keychainCredentials) {
+            log.verbose("Deferring keychain reconcile while auth flow is in progress")
+            return
+        }
+
+        log.verbose("Reconfiguring auth state machine for keychain sharing")
+        let event = AuthEvent(eventType: .reconfigure(configuration))
+        await authStateMachine.send(event)
+        await taskHelper.didStateMachineConfigured()
+    }
+
+    private func fetchCredentialsFromKeychain() async -> AmplifyCredentials? {
+        do {
+            let data = try await credentialsClient?.fetchData(type: .amplifyCredentials)
+            if case .amplifyCredentials(let credentials) = data {
+                return credentials
+            }
+            return nil
+        } catch KeychainStoreError.itemNotFound {
+            return .noCredentials
+        } catch {
+            log.verbose("Could not read shared keychain credentials: \(error)")
+            return nil
+        }
+    }
+
+    /// Best-effort snapshot of the credentials the local state machine last
+    /// observed. Returns nil for transient authZ states where we can't make a
+    /// reliable comparison; in those cases callers fall back to deferring (the
+    /// transient state will resolve shortly and a later fetch will reconcile).
+    private func fetchCredentialsFromStateMachine(_ authZState: AuthorizationState) -> AmplifyCredentials? {
+        switch authZState {
+        case .sessionEstablished(let credentials),
+             .storingCredentials(let credentials):
+            return credentials
+        case .refreshingSession(existingCredentials: let credentials, _):
+            return credentials
+        case .federatingToIdentityPool(_, _, existingCredentials: let credentials):
+            return credentials
+        case .signingOut(let credentials):
+            return credentials ?? .noCredentials
+        case .configured:
+            return .noCredentials
+        case .notConfigured,
+             .clearingFederation,
+             .fetchingUnAuthSession,
+             .fetchingAuthSessionWithUserPool,
+             .deletingUser,
+             .error:
+            return nil
+        }
+    }
+
+    private func shouldDeferReconcile(
+        authNState: AuthenticationState,
+        remote: AmplifyCredentials
+    ) -> Bool {
+        switch authNState {
+        case .signingIn:
+            // Adopt sibling sign-in; otherwise defer until local flow completes
+            return !remote.hasUserPoolTokens
+        case .signingOut,
+             .deletingUser,
+             .federatingToIdentityPool,
+             .clearingFederation:
+            return true
+        case .notConfigured,
+             .configured,
+             .signedIn,
+             .signedOut,
+             .federatedToIdentityPool,
+             .error:
+            return false
+        }
+    }
+
 }