chore: kickoff release

Author: harsh62

.github/workflows/stress_test.yml

@@ -68,6 +68,7 @@ jobs:
           scheme: AuthStressTests
           destination: ${{ env.DESTINATION }}
           xcode_path: '/Applications/Xcode_${{ env.XCODE_VERSION }}.app'
+          other_flags: -test-iterations 3 -retry-tests-on-failure -parallel-testing-enabled NO -test-repetition-relaunch-enabled YES
 
   geo-stress-test:
     needs: prepare-for-test
@@ -99,6 +100,7 @@ jobs:
           scheme: GeoStressTests
           destination: ${{ env.DESTINATION }}
           xcode_path: '/Applications/Xcode_${{ env.XCODE_VERSION }}.app'
+          other_flags: -test-iterations 3 -retry-tests-on-failure -parallel-testing-enabled NO -test-repetition-relaunch-enabled YES
 
   storage-stress-test:
     needs: prepare-for-test
@@ -130,6 +132,7 @@ jobs:
           scheme: StorageStressTests
           destination: ${{ env.DESTINATION }}
           xcode_path: '/Applications/Xcode_${{ env.XCODE_VERSION }}.app'
+          other_flags: -test-iterations 3 -retry-tests-on-failure -parallel-testing-enabled NO -test-repetition-relaunch-enabled YES
 
   datastore-stress-test:
     needs: prepare-for-test
@@ -161,6 +164,7 @@ jobs:
           scheme: DatastoreStressTests
           destination: ${{ env.DESTINATION }}
           xcode_path: '/Applications/Xcode_${{ env.XCODE_VERSION }}.app'
+          other_flags: -test-iterations 3 -retry-tests-on-failure -parallel-testing-enabled NO -test-repetition-relaunch-enabled YES
 
   graphql-api-stress-test:
     needs: prepare-for-test
@@ -191,4 +195,5 @@ jobs:
           project_path: ./AmplifyPlugins/API/Tests/APIHostApp
           scheme: GraphQLAPIStressTests
           destination: ${{ env.DESTINATION }}
-          xcode_path: '/Applications/Xcode_${{ env.XCODE_VERSION }}.app'
+          xcode_path: '/Applications/Xcode_${{ env.XCODE_VERSION }}.app'
+          other_flags: -test-iterations 3 -retry-tests-on-failure -parallel-testing-enabled NO -test-repetition-relaunch-enabled YES

AmplifyPlugins/API/Tests/APIHostApp/GraphQLAPIStressTests/GraphQLAPIStressTests.swift

@@ -41,13 +41,10 @@ final class APIStressTests: XCTestCase {
     }
 
     override func setUp() async throws {
-        await Amplify.reset()
-        Amplify.Logging.logLevel = .verbose
-        let plugin = AWSAPIPlugin(modelRegistration: TestModelRegistration())
-
         do {
+            Amplify.Logging.logLevel = .verbose
+            let plugin = AWSAPIPlugin(modelRegistration: TestModelRegistration())
             try Amplify.add(plugin: plugin)
-
             let amplifyConfig = try TestConfigHelper.retrieveAmplifyConfiguration(
                 forResource: Self.amplifyConfiguration)
             try Amplify.configure(amplifyConfig)
@@ -58,6 +55,7 @@ final class APIStressTests: XCTestCase {
 
     override func tearDown() async throws {
         await Amplify.reset()
+        try await Task.sleep(seconds: 1)
     }
 
     // MARK: - Stress tests
@@ -75,41 +73,37 @@ final class APIStressTests: XCTestCase {
         let progressInvoked = expectation(description: "progress invoked")
         progressInvoked.expectedFulfillmentCount = concurrencyLimit
 
-        let uuid = UUID().uuidString
         let testMethodName = String("\(#function)".dropLast(2))
         let title = testMethodName + "Title"
 
         let sequenceActor = SequenceActor()
         DispatchQueue.concurrentPerform(iterations: concurrencyLimit) { index in
             Task {
                 let subscription = Amplify.API.subscribe(request: .subscription(of: Post.self, type: .onCreate))
-                Task {
-                    for try await subscriptionEvent in subscription {
-                        switch subscriptionEvent {
-                        case .connection(let state):
-                            switch state {
-                            case .connecting:
-                                break
-                            case .connected:
-                                connectedInvoked.fulfill()
-                            case .disconnected:
-                                disconnectedInvoked.fulfill()
-                            }
-                        case .data(let result):
-                            switch result {
-                            case .success(let post):
-                                if post.id == uuid {
-                                    progressInvoked.fulfill()
-                                }
-                            case .failure(let error):
-                                XCTFail("\(error)")
+                await sequenceActor.append(sequence: subscription)
+                for try await subscriptionEvent in subscription {
+                    switch subscriptionEvent {
+                    case .connection(let state):
+                        switch state {
+                        case .connecting:
+                            break
+                        case .connected:
+                            connectedInvoked.fulfill()
+                        case .disconnected:
+                            disconnectedInvoked.fulfill()
+                        }
+                    case .data(let result):
+                        switch result {
+                        case .success(let post):
+                            if post.title == title {
+                                progressInvoked.fulfill()
                             }
+                        case .failure(let error):
+                            XCTFail("\(error)")
                         }
                     }
-                    completedInvoked.fulfill()
                 }
-
-                await sequenceActor.append(sequence: subscription)
+                completedInvoked.fulfill()
             }
         }
 
@@ -118,7 +112,7 @@ final class APIStressTests: XCTestCase {
         let sequenceCount = await sequenceActor.sequences.count
         XCTAssertEqual(sequenceCount, concurrencyLimit)
 
-        guard try await createPost(id: uuid, title: title) != nil else {
+        guard try await Self.createPost(id: UUID().uuidString, title: title) != nil else {
             XCTFail("Failed to create post")
             return
         }
@@ -144,7 +138,7 @@ final class APIStressTests: XCTestCase {
             Task {
                 let id = UUID().uuidString
                 let title = "title" + String(index)
-                let post = try await createPost(id: id, title: title)
+                let post = try await APIStressTests.createPost(id: id, title: title)
                 XCTAssertNotNil(post)
                 XCTAssertEqual(id, post?.id)
                 XCTAssertEqual(title, post?.title)
@@ -169,7 +163,7 @@ final class APIStressTests: XCTestCase {
             Task {
                 let id = UUID().uuidString
                 let title = "title" + String(index)
-                let post = try await createPost(id: id, title: title)
+                let post = try await APIStressTests.createPost(id: id, title: title)
                 XCTAssertNotNil(post)
                 XCTAssertEqual(id, post?.id)
                 XCTAssertEqual(title, post?.title)
@@ -184,7 +178,7 @@ final class APIStressTests: XCTestCase {
             Task {
                 var post = await postActor.posts[index]
                 post.title = "newTitle" + String(index)
-                let updatedPost = try await mutatePost(post)
+                let updatedPost = try await APIStressTests.mutatePost(post)
                 XCTAssertNotNil(updatedPost)
                 XCTAssertEqual(post.id, updatedPost.id)
                 XCTAssertEqual(post.title, updatedPost.title)
@@ -211,7 +205,7 @@ final class APIStressTests: XCTestCase {
             Task {
                 let id = UUID().uuidString
                 let title = "title" + String(index)
-                let post = try await createPost(id: id, title: title)
+                let post = try await APIStressTests.createPost(id: id, title: title)
                 XCTAssertNotNil(post)
                 XCTAssertEqual(id, post?.id)
                 XCTAssertEqual(title, post?.title)
@@ -225,7 +219,7 @@ final class APIStressTests: XCTestCase {
         DispatchQueue.concurrentPerform(iterations: concurrencyLimit) { index in
             Task {
                 let post = await postActor.posts[index]
-                let deletedPost = try await deletePost(post: post)
+                let deletedPost = try await APIStressTests.deletePost(post: post)
                 XCTAssertNotNil(deletedPost)
                 XCTAssertEqual(post.id, deletedPost.id)
                 XCTAssertEqual(post.title, deletedPost.title)
@@ -252,7 +246,7 @@ final class APIStressTests: XCTestCase {
             Task {
                 let id = UUID().uuidString
                 let title = "title" + String(index)
-                let post = try await createPost(id: id, title: title)
+                let post = try await APIStressTests.createPost(id: id, title: title)
                 XCTAssertNotNil(post)
                 XCTAssertEqual(id, post?.id)
                 XCTAssertEqual(title, post?.title)
@@ -301,12 +295,12 @@ final class APIStressTests: XCTestCase {
 
     // MARK: - Helpers
 
-    func createPost(id: String, title: String) async throws -> Post? {
+    static func createPost(id: String, title: String) async throws -> Post? {
         let post = Post(id: id, title: title, status: .active, content: "content")
         return try await createPost(post: post)
     }
 
-    func createPost(post: Post) async throws -> Post? {
+    static func createPost(post: Post) async throws -> Post? {
         let data = try await Amplify.API.mutate(request: .create(post))
         switch data {
         case .success(let post):
@@ -316,7 +310,7 @@ final class APIStressTests: XCTestCase {
         }
     }
 
-    func mutatePost(_ post: Post) async throws -> Post {
+    static func mutatePost(_ post: Post) async throws -> Post {
         let data = try await Amplify.API.mutate(request: .update(post))
         switch data {
         case .success(let post):
@@ -326,7 +320,7 @@ final class APIStressTests: XCTestCase {
         }
     }
 
-    func deletePost(post: Post) async throws -> Post {
+    static func deletePost(post: Post) async throws -> Post {
         let data = try await Amplify.API.mutate(request: .delete(post))
         switch data {
         case .success(let post):

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/CredentialStorage/AWSCognitoAuthCredentialStore.swift

@@ -56,7 +56,13 @@ struct AWSCognitoAuthCredentialStore {
         if migrateKeychainItemsOfUserSession {
             try? migrateKeychainItemsToAccessGroup()
         } else if oldAccessGroup == nil && oldAccessGroup != accessGroup {
-            try? KeychainStore(service: service)._removeAll()
+            // Only clear the old keychain if the shared keychain doesn't already have items.
+            // This prevents data loss when an app extension (e.g., widget) initializes before
+            // the main app has a chance to record the migration in UserDefaults, since
+            // UserDefaults is not shared between app and extensions.
+            if !sharedKeychainHasItems(accessGroup: accessGroup) {
+                try? KeychainStore(service: service)._removeAll()
+            }
         }
 
         saveStoredAccessGroup()
@@ -252,6 +258,15 @@ extension AWSCognitoAuthCredentialStore: AmplifyAuthCredentialStoreBehavior {
             return
         }
 
+        // If the shared keychain already has items, migration has already occurred
+        // (likely by the main app). Skip migration to prevent data loss.
+        // This check is necessary because UserDefaults is not shared between app and extensions,
+        // so the extension may not know that migration already happened.
+        if sharedKeychainHasItems(accessGroup: accessGroup) {
+            log.info("[AWSCognitoAuthCredentialStore] Shared keychain already has items, migration already completed, aborting")
+            return
+        }
+
         let oldService = oldAccessGroup != nil ? sharedService : service
         let newService = accessGroup != nil ? sharedService : service
 
@@ -265,6 +280,17 @@ extension AWSCognitoAuthCredentialStore: AmplifyAuthCredentialStoreBehavior {
         log.verbose("[AWSCognitoAuthCredentialStore] Migration of keychain items from old access group to new access group successful")
     }
 
+    /// Checks if the shared keychain (with the given access group) already contains items.
+    /// This is used to determine if migration has already occurred, which helps prevent
+    /// data loss when app extensions initialize with their own UserDefaults that don't
+    /// reflect the migration state recorded by the main app.
+    private func sharedKeychainHasItems(accessGroup: String?) -> Bool {
+        guard let accessGroup else { return false }
+
+        let sharedKeychain = KeychainStore(service: sharedService, accessGroup: accessGroup)
+        return (try? sharedKeychain._hasItems()) ?? false
+    }
+
 }
 
 /// Helpers for encode and decoding

AmplifyPlugins/Auth/Tests/AWSCognitoAuthPluginUnitTests/ActionTests/CredentialStore/MockCredentialStoreBehavior.swift

@@ -43,4 +43,8 @@ class MockKeychainStoreBehavior: KeychainStoreBehavior {
     func _removeAll() throws {
         removeAllHandler?()
     }
+
+    func _hasItems() throws -> Bool {
+        return !data.isEmpty
+    }
 }

AmplifyPlugins/Auth/Tests/AWSCognitoAuthPluginUnitTests/Support/DefaultConfig.swift

@@ -396,6 +396,10 @@ struct MockLegacyStore: KeychainStoreBehavior {
 
     }
 
+    func _hasItems() throws -> Bool {
+        return false
+    }
+
 }
 
 struct MockASF: AdvancedSecurityBehavior {

AmplifyPlugins/Core/AWSPluginsCore/Keychain/KeychainStore.swift

@@ -53,6 +53,12 @@ public protocol KeychainStoreBehavior {
     @_spi(KeychainStore)
     func _removeAll() throws
 
+    /// Checks if the Keychain contains any items for this service and access group.
+    /// This System Programming Interface (SPI) may have breaking changes in future updates.
+    /// - Returns: `true` if at least one item exists, `false` otherwise
+    @_spi(KeychainStore)
+    func _hasItems() throws -> Bool
+
 }
 
 public struct KeychainStore: KeychainStoreBehavior {
@@ -233,6 +239,29 @@ public struct KeychainStore: KeychainStoreBehavior {
         log.verbose("[KeychainStore] Successfully removed all items from keychain")
     }
 
+    /// Checks if the Keychain contains any items for this service and access group.
+    /// This System Programming Interface (SPI) may have breaking changes in future updates.
+    /// - Returns: `true` if at least one item exists, `false` otherwise
+    @_spi(KeychainStore)
+    public func _hasItems() throws -> Bool {
+        log.verbose("[KeychainStore] Checking if keychain has any items")
+        var query = attributes.defaultGetQuery()
+        query[Constants.MatchLimit] = Constants.MatchLimitOne
+
+        let status = SecItemCopyMatching(query as CFDictionary, nil)
+        switch status {
+        case errSecSuccess:
+            log.verbose("[KeychainStore] Keychain has items")
+            return true
+        case errSecItemNotFound:
+            log.verbose("[KeychainStore] Keychain has no items")
+            return false
+        default:
+            log.error("[KeychainStore] Error checking keychain items with status=\(status)")
+            throw KeychainStoreError.securityError(status)
+        }
+    }
+
 }
 
 extension KeychainStore {

AmplifyPlugins/Internal/Tests/InternalAWSPinpointUnitTests/Mocks/MockKeychainStore.swift

@@ -62,6 +62,10 @@ class MockKeychainStore: KeychainStoreBehavior {
         dataValues.removeAll()
     }
 
+    func _hasItems() throws -> Bool {
+        return !stringValues.isEmpty || !dataValues.isEmpty
+    }
+
     func resetCounters() {
         dataForKeyCount = 0
         stringForKeyCount = 0

AmplifyPlugins/Logging/Sources/AWSCloudWatchLoggingPlugin/Persistence/LogRotation.swift

@@ -209,9 +209,9 @@ final class LogRotation {
             contents: nil,
             attributes: [FileAttributeKey: Any]()
         )
-        if #available(macOS 11.0, *) {
+        if #available(macOS 11.0, iOS 9.0, *) {
             let resourceValues: [URLResourceKey: Any] = [
-                URLResourceKey.fileProtectionKey: URLFileProtection.complete,
+                URLResourceKey.fileProtectionKey: URLFileProtection.completeUntilFirstUserAuthentication,
                 URLResourceKey.isExcludedFromBackupKey: true
             ]
             try (fileURL as NSURL).setResourceValues(resourceValues)