Repository navigation
Allow one app group on free teams - #284
cesardev31 wants to merge 1 commit into
Conversation
Resolves the FIXME in DeveloperServicesCapability: free teams can register and assign app groups through the Xcode DeveloperServices API, so App Groups are no longer filtered out for them, and DeveloperServicesAddAppOperation assigns at most one group per app on a free team.
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (2)
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review. 📝 WalkthroughWalkthroughApp Groups are now marked as available to free teams. When an app is added for a free team, the operation passes at most the first group from its existing entitlement. ChangesFree Team App Groups
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~5 minutes Change: Bug fix Merge Risk: ⚪ Minimal · up to The examined paths do not leave extra App Groups assigned or in the returned entitlement. No actionable merge-blocking issue remains after normal checks. Security Architecture ReviewSecurity architecture risk: 🟡 Moderate · up to Free teams gain an intended shared-data capability. The one-group limit is applied to each provisioning request, but it is unclear whether it remains effective when an existing app is provisioned again with a different group. Retained concerns
Security review detailsSecurity Blast Radius
Security Findings and Attack Paths
Trust Boundaries and Controls
Resilience and Maintainability Implications
Hardening Proposals
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
The patch is now the diff of xtool-org/xtool#284: besides allowing App Groups on free teams, it assigns at most one group per app, as the FIXME it resolves asked. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LbkuTKpirPsGTLYJjm6UAB
kabiroberai
left a comment
There was a problem hiding this comment.
Thanks, small suggestions
| // but we need to always assign only one group | ||
| DeveloperServicesCapability(.appGroups, isFree: false) | ||
| // Free teams can use App Groups too; DeveloperServicesAddAppOperation | ||
| // assigns them at most one. |
There was a problem hiding this comment.
nit: this comment is unnecessary
| let groupsEntitlement = entitlementsArray[groupsIdx] as? AppGroupEntitlement { | ||
| let groups = groupsEntitlement.rawValue | ||
| // Free teams get at most one app group per app. | ||
| let groups = isFreeTeam ? Array(groupsEntitlement.rawValue.prefix(1)) : groupsEntitlement.rawValue |
There was a problem hiding this comment.
would prefer throwing if there's more than one group. using prefix(1) means the other groups will just silently fail to be created.
What does this PR do?
Resolves the FIXME in
DeveloperServicesCapability: App Groups are no longer filtered out on free teams, andDeveloperServicesAddAppOperationassigns at most one group per app on a free team (the constraint the FIXME mentioned).Free teams can register and assign app groups through the Xcode DeveloperServices API (as AltStore/SideStore do), so a widget and its app can share
UserDefaults(suiteName:)with a free Apple ID.How was it tested?
Built on Linux from
main(4d0c429). Installed a Flutter app with a WidgetKit extension on an iPhone (iOS 27.2) with a free Apple ID: the app getsgroup.XTL-<team>.<id>in its entitlements and the widget reads the app's data through it.make lintnot run (no SwiftLint on this machine).AI tool usage
How much of this PR was AI-assisted? (check one)
Summary by CodeRabbit