chore: kickoff release

Author: harsh62

.github/workflows/dependency-review.yml

@@ -20,6 +20,6 @@ jobs:
           persist-credentials: false
 
       - name: Dependency Review
-        uses: actions/dependency-review-action@7d90b4f05fea31dde1c4a1fb3fa787e197ea93ab # v3.0.7
+        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
         with:
           config-file: amazon-ospo/dependency-review-config/default/dependency-review-config.yml@main

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/CredentialStorage/AWSCognitoAuthCredentialStore.swift

@@ -21,11 +21,6 @@ struct AWSCognitoAuthCredentialStore {
 
     // User defaults constants
     private let userDefaultsNameSpace = "amplify_secure_storage_scopes.awsCognitoAuthPlugin"
-    /// This UserDefault Key is used to check if Keychain already has items stored on a fresh install
-    /// If this flag doesn't exist, previous keychain values for Amplify would be wiped out
-    private var isKeychainConfiguredKey: String {
-        "\(userDefaultsNameSpace).isKeychainConfigured"
-    }
     /// This UserDefaults Key is use to retrieve the stored access group to determine
     /// which access group the migration should happen from
     /// If none is found, the unshared service is used for migration and all items
@@ -67,16 +62,16 @@ struct AWSCognitoAuthCredentialStore {
 
         saveStoredAccessGroup()
 
-        if !userDefaults.bool(forKey: isKeychainConfiguredKey) {
-            // We can't reliably clear credentials if the Keychain has a shared access group.
-            // This is because each app/extension has its own UserDefaults.
-            // If a user authenticates in an app, the app or extension that shares the keychain would clear the shared credentials.
-            // We must only clear credentials if a shared Keychain is not being used.
-            if accessGroup == nil {
-                try? clearAllCredentials() // clear if not using shared keychain
-            }
-            userDefaults.set(true, forKey: isKeychainConfiguredKey)
-        }
+        // NOTE: We intentionally do NOT clear keychain credentials on app reinstall.
+        // Previously, this code checked a UserDefaults flag (isKeychainConfiguredKey) to detect
+        // fresh installs and clear orphaned keychain items. However, this approach was unreliable
+        // because UserDefaults can return false during iOS prewarming (background app launch after
+        // device reboot) when protected data is not yet available. This caused valid credentials
+        // to be incorrectly cleared, resulting in random user logouts.
+        //
+        // Keychain items persisting across app reinstalls is iOS's default behavior. Any stale
+        // credentials will naturally fail authentication and trigger a proper sign-out flow.
+        // See: https://github.com/aws-amplify/amplify-swift/issues/3972
 
         restoreCredentialsOnConfigurationChanges(currentAuthConfig: authConfiguration)
         // Save the current configuration

AmplifyPlugins/Auth/Tests/AuthHostApp/AuthIntegrationTests/CredentialStore/CredentialStoreConfigurationTests.swift

@@ -7,17 +7,44 @@
 
 import XCTest
 @testable import AWSCognitoAuthPlugin
+@_spi(KeychainStore) import AWSPluginsCore
 
 class CredentialStoreConfigurationTests: AWSAuthBaseTest {
 
+    private let service = "com.amplify.awsCognitoAuthPlugin"
+    private let sharedService = "com.amplify.awsCognitoAuthPluginShared"
+
     override func setUp() async throws {
         try await super.setUp()
-        AuthSessionHelper.clearSession()
+        clearAllKeychains()
+        // Clear access group UserDefaults to ensure clean state for migration tests
+        UserDefaults.standard.removeObject(forKey: "amplify_secure_storage_scopes.awsCognitoAuthPlugin.accessGroup")
     }
 
     override func tearDown() async throws {
         try await super.tearDown()
-        AuthSessionHelper.clearSession()
+        clearAllKeychains()
+        // Clear access group UserDefaults
+        UserDefaults.standard.removeObject(forKey: "amplify_secure_storage_scopes.awsCognitoAuthPlugin.accessGroup")
+    }
+
+    /// Clears all keychain items (both shared and non-shared) to ensure clean test state
+    private func clearAllKeychains() {
+        // Clear non-shared keychain
+        let nonSharedKeychain = KeychainStore(service: service)
+        try? nonSharedKeychain._removeAll()
+
+        // Clear shared keychains for all access groups used in tests
+        #if os(watchOS)
+        let accessGroups = [keychainAccessGroupWatch, keychainAccessGroupWatch2]
+        #else
+        let accessGroups = [keychainAccessGroup, keychainAccessGroup2]
+        #endif
+
+        for accessGroup in accessGroups {
+            let sharedKeychain = KeychainStore(service: sharedService, accessGroup: accessGroup)
+            try? sharedKeychain._removeAll()
+        }
     }
 
     /// Test successful migration of credentials when auth configuration changes
@@ -229,12 +256,11 @@ class CredentialStoreConfigurationTests: AWSAuthBaseTest {
         }
 
         // When configuration don't change changed
-        UserDefaults.standard.removeObject(forKey: "amplify_secure_storage_scopes.awsCognitoAuthPlugin.isKeychainConfigured")
         let newCredentialStore = AWSCognitoAuthCredentialStore(authConfiguration: initialAuthConfig)
 
         // Then credentials should be nil
         let credentials = try? newCredentialStore.retrieveCredential()
-        XCTAssertNil(credentials)
+        XCTAssertNotNil(credentials)
     }
 
     /// Test migrating to a shared access group keeps credentials
@@ -679,51 +705,11 @@ class CredentialStoreConfigurationTests: AWSAuthBaseTest {
         }
         XCTAssertNotNil(savedCredentials)
 
-        // When: Simulate fresh install by clearing UserDefaults flag
-        UserDefaults.standard.removeObject(forKey: "amplify_secure_storage_scopes.awsCognitoAuthPlugin.isKeychainConfigured")
-
         // Initialize new credential store without access group
         let newCredentialStore = AWSCognitoAuthCredentialStore(authConfiguration: authConfig)
 
         // Then: Non-shared keychain credentials should be cleared
         let retrievedCredentials = try? newCredentialStore.retrieveCredential()
-        XCTAssertNil(retrievedCredentials, "Non-shared keychain credentials should be cleared on fresh install")
-    }
-
-    /// Test that UserDefaults flag is properly set regardless of access group usage
-    ///
-    /// - Given: Fresh UserDefaults state
-    /// - When: Credential store is initialized with or without access group
-    /// - Then: UserDefaults flag should be set in both cases
-    ///
-    func testUserDefaultsFlagSetRegardlessOfAccessGroup() {
-        let authConfig = AuthConfiguration.userPoolsAndIdentityPools(
-            Defaults.makeDefaultUserPoolConfigData(),
-            Defaults.makeIdentityConfigData()
-        )
-        let userDefaultsKey = "amplify_secure_storage_scopes.awsCognitoAuthPlugin.isKeychainConfigured"
-
-        // Test without access group
-        UserDefaults.standard.removeObject(forKey: userDefaultsKey)
-        XCTAssertFalse(UserDefaults.standard.bool(forKey: userDefaultsKey))
-
-        _ = AWSCognitoAuthCredentialStore(authConfiguration: authConfig)
-        XCTAssertTrue(UserDefaults.standard.bool(forKey: userDefaultsKey))
-
-        // Test with access group
-        UserDefaults.standard.removeObject(forKey: userDefaultsKey)
-        XCTAssertFalse(UserDefaults.standard.bool(forKey: userDefaultsKey))
-
-        #if os(watchOS)
-        let accessGroup = keychainAccessGroupWatch
-        #else
-        let accessGroup = keychainAccessGroup
-        #endif
-
-        _ = AWSCognitoAuthCredentialStore(
-            authConfiguration: authConfig,
-            accessGroup: accessGroup
-        )
-        XCTAssertTrue(UserDefaults.standard.bool(forKey: userDefaultsKey))
+        XCTAssertNotNil(retrievedCredentials, "Non-shared keychain credentials should NOT be cleared on fresh install")
     }
 }

AmplifyPlugins/Logging/Sources/AWSCloudWatchLoggingPlugin/Persistence/LogFile.swift

@@ -30,7 +30,7 @@ final class LogFile {
         self.sizeLimitInBytes = sizeLimitInBytes
         self.handle = try FileHandle(forUpdating: fileURL)
         if #available(macOS 12.0, iOS 13.4, watchOS 6.2, tvOS 13.4, *) {
-            self.count = try self.handle.offset()
+            self.count = try handle.offset()
         } else {
             self.count = handle.offsetInFile
         }
@@ -68,7 +68,7 @@ final class LogFile {
     /// Data  to the underlying log file.
     func write(data: Data) throws {
         if #available(macOS 12.0, iOS 13.4, watchOS 6.2, tvOS 13.4, *) {
-            try self.handle.write(contentsOf: data)
+            try handle.write(contentsOf: data)
         } else {
             handle.write(data)
         }

Gemfile.lock

@@ -30,21 +30,24 @@ GEM
       json (>= 1.5.1)
     artifactory (3.0.15)
     atomos (0.1.3)
-    aws-eventstream (1.2.0)
-    aws-partitions (1.709.0)
-    aws-sdk-core (3.170.0)
-      aws-eventstream (~> 1, >= 1.0.2)
-      aws-partitions (~> 1, >= 1.651.0)
-      aws-sigv4 (~> 1.5)
+    aws-eventstream (1.4.0)
+    aws-partitions (1.1196.0)
+    aws-sdk-core (3.240.0)
+      aws-eventstream (~> 1, >= 1.3.0)
+      aws-partitions (~> 1, >= 1.992.0)
+      aws-sigv4 (~> 1.9)
+      base64
+      bigdecimal
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-kms (1.62.0)
-      aws-sdk-core (~> 3, >= 3.165.0)
-      aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.119.0)
-      aws-sdk-core (~> 3, >= 3.165.0)
+      logger
+    aws-sdk-kms (1.118.0)
+      aws-sdk-core (~> 3, >= 3.239.1)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-s3 (1.208.0)
+      aws-sdk-core (~> 3, >= 3.234.0)
       aws-sdk-kms (~> 1)
-      aws-sigv4 (~> 1.4)
-    aws-sigv4 (1.5.2)
+      aws-sigv4 (~> 1.5)
+    aws-sigv4 (1.12.1)
       aws-eventstream (~> 1, >= 1.0.2)
     babosa (1.0.4)
     base64 (0.2.0)
@@ -234,6 +237,7 @@ GEM
     jwt (2.9.1)
       base64
     liferaft (0.0.6)
+    logger (1.7.0)
     mini_magick (4.12.0)
     mini_mime (1.1.5)
     mini_portile2 (2.8.7)

canaries/example/Gemfile.lock

@@ -7,24 +7,28 @@ GEM
       public_suffix (>= 2.0.2, < 7.0)
     artifactory (3.0.17)
     atomos (0.1.3)
-    aws-eventstream (1.2.0)
-    aws-partitions (1.575.0)
-    aws-sdk-core (3.130.0)
-      aws-eventstream (~> 1, >= 1.0.2)
-      aws-partitions (~> 1, >= 1.525.0)
-      aws-sigv4 (~> 1.1)
-      jmespath (~> 1.0)
-    aws-sdk-kms (1.55.0)
-      aws-sdk-core (~> 3, >= 3.127.0)
-      aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.113.0)
-      aws-sdk-core (~> 3, >= 3.127.0)
+    aws-eventstream (1.4.0)
+    aws-partitions (1.1197.0)
+    aws-sdk-core (3.240.0)
+      aws-eventstream (~> 1, >= 1.3.0)
+      aws-partitions (~> 1, >= 1.992.0)
+      aws-sigv4 (~> 1.9)
+      base64
+      bigdecimal
+      jmespath (~> 1, >= 1.6.1)
+      logger
+    aws-sdk-kms (1.118.0)
+      aws-sdk-core (~> 3, >= 3.239.1)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-s3 (1.208.0)
+      aws-sdk-core (~> 3, >= 3.234.0)
       aws-sdk-kms (~> 1)
-      aws-sigv4 (~> 1.4)
-    aws-sigv4 (1.4.0)
+      aws-sigv4 (~> 1.5)
+    aws-sigv4 (1.12.1)
       aws-eventstream (~> 1, >= 1.0.2)
     babosa (1.0.4)
     base64 (0.2.0)
+    bigdecimal (4.0.1)
     claide (1.1.0)
     colored (1.2)
     colored2 (3.1.2)
@@ -155,6 +159,7 @@ GEM
     json (2.6.1)
     jwt (2.10.2)
       base64
+    logger (1.7.0)
     mini_magick (4.13.2)
     mini_mime (1.1.5)
     multi_json (1.15.0)