Merge pull request '[lececryptokit-1.0.3] Bump LCECryptoKitBinary and expose pepper-refactor login primitives' (#9) from chore/deps/lececryptokit-1.0.3 into main

Reviewed-on: #9

Package.resolved

@@ -1,5 +1,5 @@
 {
-  "originHash" : "33e7d52ad13cf774717778548edb365d33ff62d766d0049165bc8970f19a23ef",
+  "originHash" : "967609fc5437e21be07c4206e2daefc73c3c7522601e64540f0dd5f115b19a6d",
   "pins" : [
     {
       "identity" : "lcecryptokitbinary",
@@ -7,7 +7,7 @@
       "location" : "https://60c260c85d3a2fe840411b0ff98f521b5eca3c56@git.loverde.com.br/Loverde-Company-LTDA/LCECryptoKitBinary.git",
       "state" : {
         "revision" : "2c5c47cebef40a8adc5557d071a35be405c05e30",
-        "version" : "1.0.2"
+        "version" : "1.0.3"
       }
     }
   ],

Package.swift

@@ -11,7 +11,7 @@ let cryptoPackageURL = isLocalDevelopment
 
 let packageDependencies: [Package.Dependency] = enableCryptoBinary
     ? [
-        .package(url: cryptoPackageURL, exact: "1.0.2")
+        .package(url: cryptoPackageURL, exact: "1.0.3")
       ]
     : []
 

Sources/LCEssentials/Classes/LCECrypto.swift

@@ -58,6 +58,28 @@ public final class LCECryptoKitManager {
     public func decodeOTPWithKey(_ otpHash: String) -> Bool {
         LCECryptoKit.decodeSeed(otpKey: otpHash, hashKey: self.hashKey)
     }
+
+    // MARK: - Salted/Iterated/Peppered Login (atomenta-cryptokit-pepper-refactor-sdd.md)
+
+    public static func generateSalt() -> String {
+        LCECryptoKit.generateSalt()
+    }
+
+    public static func computeClientHash(email: String, password: String, salt: String) -> String {
+        LCECryptoKit.computeClientHash(email: email, password: password, salt: salt)
+    }
+
+    public static func computeLoginBearerToken(userId: String, clientHash: String) -> String? {
+        LCECryptoKit.computeLoginBearerToken(userId: userId, clientHash: clientHash)
+    }
+
+    public static func otpEncode(_ plainText: String) -> String? {
+        LCECryptoKit.otpEncode(plainText)
+    }
+
+    public static func otpDecode(_ otpEncoded: String) -> String? {
+        LCECryptoKit.otpDecode(otpEncoded)
+    }
 }
 #else
 
@@ -92,5 +114,27 @@ public final class LCECryptoKitManager {
     public func decodeOTPWithKey(_ otpHash: String) -> Bool {
         false
     }
+
+    // MARK: - Salted/Iterated/Peppered Login (atomenta-cryptokit-pepper-refactor-sdd.md)
+
+    public static func generateSalt() -> String {
+        ""
+    }
+
+    public static func computeClientHash(email: String, password: String, salt: String) -> String {
+        ""
+    }
+
+    public static func computeLoginBearerToken(userId: String, clientHash: String) -> String? {
+        nil
+    }
+
+    public static func otpEncode(_ plainText: String) -> String? {
+        nil
+    }
+
+    public static func otpDecode(_ otpEncoded: String) -> String? {
+        nil
+    }
 }
 #endif

Sources/LCEssentials/Classes/LCEssentials+API.swift

@@ -194,14 +194,31 @@ public struct API {
                 API.requestLOG(method: method, request: request)
             }
             
-            let session = URLSession(
+            // Only spin up a dedicated session (with its own @MainActor
-                configuration: .default,
+            // delegate hop for every TLS/auth challenge) when client
-                delegate: URLSessionDelegateHandler(
+            // certificate auth is actually configured. Creating one of
-                    certData: API.certData,
+            // these per request unconditionally — and never invalidating
-                    password: API.certPassword
+            // it — could stall the async challenge callback waiting on an
-                ),
+            // already-busy MainActor, hanging the request indefinitely with
-                delegateQueue: nil
+            // no timeout or error ever surfacing. The common case (no
-            )
+            // client cert) uses the shared session, which has none of this
+            // risk and is what URLSession is designed to be reused as.
+            let usesCertSession = API.certData != nil
+            let session: URLSession = usesCertSession
+                ? URLSession(
+                    configuration: .default,
+                    delegate: URLSessionDelegateHandler(
+                        certData: API.certData,
+                        password: API.certPassword
+                    ),
+                    delegateQueue: nil
+                )
+                : URLSession.shared
+            defer {
+                if usesCertSession {
+                    session.finishTasksAndInvalidate()
+                }
+            }
             do {
                 let (data, response) = try await session.data(for: request)