chore: kickoff release

.github/composite_actions/get_platform_parameters/action.yml

@@ -41,7 +41,7 @@ runs:
 
     - id: get-xcode-version
       run: |
-        LATEST_XCODE_VERSION=16.0.0
+        LATEST_XCODE_VERSION=16.2.0
         MINIMUM_XCODE_VERSION=15.0.1
 
         INPUT_XCODE_VERSION=${{ inputs.xcode_version }}
@@ -67,31 +67,31 @@ runs:
         case $INPUT_PLATFORM/$INPUT_XCODE_VERSION in
           iOS/latest) 
             DEVICE="iPhone 16"
-            OS_VERSION="18.0"
+            OS_VERSION="18.2"
             ;;
           iOS/*)
-            DEVICE="iPhone 14"
-            OS_VERSION="17.0.1"
+            DEVICE="iPhone 15"
+            OS_VERSION="17.0"
             ;;
           tvOS/latest)
             DEVICE="Apple TV 4K (3rd generation)"
-            OS_VERSION="18.0"
+            OS_VERSION="18.2"
             ;;
           tvOS/*)
             DEVICE="Apple TV 4K (3rd generation)"
             OS_VERSION="17.0"
             ;;
           watchOS/latest)
             DEVICE="Apple Watch Series 10 (46mm)"
-            OS_VERSION="11.0"
+            OS_VERSION="11.2"
             ;;
           watchOS/*)
-            DEVICE="Apple Watch Series 8 (45mm)"
+            DEVICE="Apple Watch Series 7 (45mm)"
             OS_VERSION="10.0"
             ;;
           visionOS/latest)
             DEVICE="Apple Vision Pro"
-            OS_VERSION="2.0"
+            OS_VERSION="2.2"
             ;;
           visionOS/*)
             DEVICE="Apple Vision Pro"

.github/workflows/build_scheme.yml

@@ -56,6 +56,7 @@ jobs:
 
       - name: Attempt to restore the build cache from main
         id: build-cache
+        if: steps.dependencies-cache.outputs.cache-hit
         timeout-minutes: 4
         continue-on-error: true
         uses: actions/cache/restore@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1

.github/workflows/codeql.yml

@@ -47,7 +47,6 @@ jobs:
       with:
         languages: ${{ matrix.language }}
         config-file: ./.github/codeql/config.yml
-        debug: true
 
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@822fe5ef9a15bd752ef127e9ff6eac38ec37dd9c

.github/workflows/integ_test_auth_webauthn.yml

@@ -56,6 +56,7 @@ jobs:
 
       - name: Attempt to restore the build cache
         id: build-cache
+        if: steps.dependencies-cache.outputs.cache-hit
         timeout-minutes: 4
         continue-on-error: true
         uses: actions/cache/restore@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1

.github/workflows/integ_test_push_notifications.yml

@@ -26,7 +26,7 @@ permissions:
 jobs:
   push-notification-integration-tests:
     name: ${{ matrix.platform }} Tests | PushNotificationHostApp
-    runs-on: macos-latest
+    runs-on: macos-15
     timeout-minutes: 30
     environment: IntegrationTest
     strategy:
@@ -79,6 +79,7 @@ jobs:
 
       - name: Attempt to restore the build cache
         id: build-cache
+        if: steps.dependencies-cache.outputs.cache-hit
         timeout-minutes: 4
         continue-on-error: true
         uses: actions/cache/restore@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1

.github/workflows/run_integration_tests.yml

@@ -82,6 +82,7 @@ jobs:
 
       - name: Attempt to restore the build cache
         id: build-cache
+        if: steps.dependencies-cache.outputs.cache-hit
         timeout-minutes: 4
         continue-on-error: true
         uses: actions/cache/restore@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1

.github/workflows/run_unit_tests.yml

@@ -70,6 +70,7 @@ jobs:
 
       - name: Attempt to restore the build cache
         id: build-cache
+        if: steps.dependencies-cache.outputs.cache-hit
         timeout-minutes: 4
         continue-on-error: true
         uses: actions/cache/restore@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1

.github/workflows/stress_test.yml

@@ -14,7 +14,7 @@ concurrency:
 
 jobs:
   prepare-for-test:
-    runs-on: macos-latest
+    runs-on: macos-15
     environment: IntegrationTest
     outputs:
       destination: ${{ steps.platform.outputs.destination }}
@@ -40,7 +40,7 @@ jobs:
 
   auth-stress-test:
     needs: prepare-for-test
-    runs-on: macos-latest
+    runs-on: macos-15
     environment: IntegrationTest
     env:
       DESTINATION: ${{ needs.prepare-for-test.outputs.destination }}
@@ -71,7 +71,7 @@ jobs:
 
   geo-stress-test:
     needs: prepare-for-test
-    runs-on: macos-latest
+    runs-on: macos-15
     environment: IntegrationTest
     env:
       DESTINATION: ${{ needs.prepare-for-test.outputs.destination }}
@@ -102,7 +102,7 @@ jobs:
 
   storage-stress-test:
     needs: prepare-for-test
-    runs-on: macos-latest
+    runs-on: macos-15
     environment: IntegrationTest
     env:
       DESTINATION: ${{ needs.prepare-for-test.outputs.destination }}
@@ -133,7 +133,7 @@ jobs:
 
   datastore-stress-test:
     needs: prepare-for-test
-    runs-on: macos-latest
+    runs-on: macos-15
     environment: IntegrationTest
     env:
       DESTINATION: ${{ needs.prepare-for-test.outputs.destination }}
@@ -164,7 +164,7 @@ jobs:
 
   graphql-api-stress-test:
     needs: prepare-for-test
-    runs-on: macos-latest
+    runs-on: macos-15
     environment: IntegrationTest
     env:
       DESTINATION: ${{ needs.prepare-for-test.outputs.destination }}

Amplify/Categories/Auth/Models/AccessGroup.swift

@@ -0,0 +1,51 @@
+//
+// Copyright Amazon.com Inc. or its affiliates.
+// All Rights Reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+import Foundation
+
+/// A structure representing an access group for managing keychain items.
+public struct AccessGroup {
+    /// The name of the access group.
+    public let name: String?
+
+    /// A flag indicating whether to migrate keychain items.
+    public let migrateKeychainItems: Bool
+
+    /**
+     Initializes an `AccessGroup` with the specified name and migration option.
+
+     - Parameter name: The name of the access group.
+     - Parameter migrateKeychainItemsOfUserSession: A flag indicating whether to migrate keychain items. Defaults to `false`.
+     */
+    public init(name: String, migrateKeychainItemsOfUserSession: Bool = false) {
+        self.init(name: name, migrateKeychainItems: migrateKeychainItemsOfUserSession)
+    }
+
+    /**
+     Creates an `AccessGroup` instance with no specified name.
+
+     - Parameter migrateKeychainItemsOfUserSession: A flag indicating whether to migrate keychain items.
+     - Returns: An `AccessGroup` instance with the migration option set.
+     */
+    public static func none(migrateKeychainItemsOfUserSession: Bool) -> AccessGroup {
+        return .init(migrateKeychainItems: migrateKeychainItemsOfUserSession)
+    }
+
+    /**
+     A static property representing an `AccessGroup` with no name and no migration.
+
+     - Returns: An `AccessGroup` instance with no name and the migration option set to `false`.
+     */
+    public static var none: AccessGroup {
+        return .none(migrateKeychainItemsOfUserSession: false)
+    }
+
+    private init(name: String? = nil, migrateKeychainItems: Bool) {
+        self.name = name
+        self.migrateKeychainItems = migrateKeychainItems
+    }
+}

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/AWSCognitoAuthPlugin+Configure.swift

@@ -186,7 +186,11 @@ extension AWSCognitoAuthPlugin {
     }
 
     private func makeCredentialStore() -> AmplifyAuthCredentialStoreBehavior {
-        AWSCognitoAuthCredentialStore(authConfiguration: authConfiguration)
+        return AWSCognitoAuthCredentialStore(
+            authConfiguration: authConfiguration,
+            accessGroup: secureStoragePreferences?.accessGroup?.name,
+            migrateKeychainItemsOfUserSession: secureStoragePreferences?.accessGroup?.migrateKeychainItems ?? false
+        )
     }
 
     private func makeLegacyKeychainStore(service: String) -> KeychainStoreBehavior {

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/AWSCognitoAuthPlugin.swift

@@ -35,6 +35,9 @@ public final class AWSCognitoAuthPlugin: AWSCognitoAuthPluginBehavior {
     /// The user network preferences for timeout and retry
     let networkPreferences: AWSCognitoNetworkPreferences?
 
+    /// The user secure storage preferences for access group
+    let secureStoragePreferences: AWSCognitoSecureStoragePreferences?
+
     @_spi(InternalAmplifyConfiguration)
     internal(set) public var jsonConfiguration: JSONValue?
 
@@ -43,15 +46,14 @@ public final class AWSCognitoAuthPlugin: AWSCognitoAuthPluginBehavior {
         return "awsCognitoAuthPlugin"
     }
 
-    /// Instantiates an instance of the AWSCognitoAuthPlugin.
-    public init() {
-        self.networkPreferences = nil
-    }
-
-    /// Instantiates an instance of the AWSCognitoAuthPlugin with custom network preferences
+    /// Instantiates an instance of the AWSCognitoAuthPlugin with optional custom network
+    /// preferences and optional custom secure storage preferences
     /// - Parameters:
     ///   - networkPreferences: network preferences
-    public init(networkPreferences: AWSCognitoNetworkPreferences) {
+    ///   - secureStoragePreferences: secure storage preferences
+    public init(networkPreferences: AWSCognitoNetworkPreferences? = nil,
+                secureStoragePreferences: AWSCognitoSecureStoragePreferences = AWSCognitoSecureStoragePreferences()) {
         self.networkPreferences = networkPreferences
+        self.secureStoragePreferences = secureStoragePreferences
     }
 }

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/ClientBehavior/AWSCognitoAuthPlugin+ClientBehavior.swift

@@ -114,7 +114,11 @@ extension AWSCognitoAuthPlugin: AuthCategoryBehavior {
     public func fetchAuthSession(options: AuthFetchSessionRequest.Options?) async throws -> AuthSession {
         let options = options ?? AuthFetchSessionRequest.Options()
         let request = AuthFetchSessionRequest(options: options)
-        let task = AWSAuthFetchSessionTask(request, authStateMachine: authStateMachine)
+        let forceReconfigure = secureStoragePreferences?.accessGroup?.name != nil
+        let task = AWSAuthFetchSessionTask(request,
+                                           authStateMachine: authStateMachine,
+                                           configuration: authConfiguration,
+                                           forceReconfigure: forceReconfigure)
         return try await taskQueue.sync {
             return try await task.value
         } as! AuthSession

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/CredentialStorage/AWSCognitoAuthCredentialStore.swift

@@ -13,6 +13,7 @@ struct AWSCognitoAuthCredentialStore {
 
     // Credential store constants
     private let service = "com.amplify.awsCognitoAuthPlugin"
+    private let sharedService = "com.amplify.awsCognitoAuthPluginShared"
     private let sessionKey = "session"
     private let deviceMetadataKey = "deviceMetadata"
     private let deviceASFKey = "deviceASF"
@@ -25,14 +26,40 @@ struct AWSCognitoAuthCredentialStore {
     private var isKeychainConfiguredKey: String {
         "\(userDefaultsNameSpace).isKeychainConfigured"
     }
+    /// This UserDefaults Key is use to retrieve the stored access group to determine
+    /// which access group the migration should happen from
+    /// If none is found, the unshared service is used for migration and all items
+    /// under that service are queried
+    private var accessGroupKey: String {
+        "\(userDefaultsNameSpace).accessGroup"
+    }
 
     private let authConfiguration: AuthConfiguration
     private let keychain: KeychainStoreBehavior
     private let userDefaults = UserDefaults.standard
+    private let accessGroup: String?
 
-    init(authConfiguration: AuthConfiguration, accessGroup: String? = nil) {
+    init(
+        authConfiguration: AuthConfiguration,
+        accessGroup: String? = nil,
+        migrateKeychainItemsOfUserSession: Bool = false
+    ) {
         self.authConfiguration = authConfiguration
-        self.keychain = KeychainStore(service: service, accessGroup: accessGroup)
+        self.accessGroup = accessGroup
+        if let accessGroup {
+            self.keychain = KeychainStore(service: sharedService, accessGroup: accessGroup)
+        } else {
+            self.keychain = KeychainStore(service: service)
+        }
+
+        let oldAccessGroup = retrieveStoredAccessGroup()
+        if migrateKeychainItemsOfUserSession {
+            try? migrateKeychainItemsToAccessGroup()
+        } else if oldAccessGroup == nil && oldAccessGroup != accessGroup {
+            try? KeychainStore(service: service)._removeAll()
+        }
+
+        saveStoredAccessGroup()
 
         if !userDefaults.bool(forKey: isKeychainConfiguredKey) {
             try? clearAllCredentials()
@@ -181,6 +208,39 @@ extension AWSCognitoAuthCredentialStore: AmplifyAuthCredentialStoreBehavior {
     private func clearAllCredentials() throws {
         try keychain._removeAll()
     }
+
+    private func retrieveStoredAccessGroup() -> String? {
+        return userDefaults.string(forKey: accessGroupKey)
+    }
+
+    private func saveStoredAccessGroup() {
+        if let accessGroup {
+            userDefaults.set(accessGroup, forKey: accessGroupKey)
+        } else {
+            userDefaults.removeObject(forKey: accessGroupKey)
+        }
+    }
+
+    private func migrateKeychainItemsToAccessGroup() throws {
+        let oldAccessGroup = retrieveStoredAccessGroup()
+
+        if oldAccessGroup == accessGroup {
+            log.info("[AWSCognitoAuthCredentialStore] Stored access group is the same as current access group, aborting migration")
+            return
+        }
+
+        let oldService = oldAccessGroup != nil ? sharedService : service
+        let newService = accessGroup != nil ? sharedService : service
+
+        do {
+            try KeychainStoreMigrator(oldService: oldService, newService: newService, oldAccessGroup: oldAccessGroup, newAccessGroup: accessGroup).migrate()
+        } catch {
+            log.error("[AWSCognitoAuthCredentialStore] Migration has failed")
+            return
+        }
+
+        log.verbose("[AWSCognitoAuthCredentialStore] Migration of keychain items from old access group to new access group successful")
+    }
 
 }
 
@@ -204,3 +264,5 @@ private extension AWSCognitoAuthCredentialStore {
     }
 
 }
+
+extension AWSCognitoAuthCredentialStore: DefaultLogger { }

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Models/AWSCognitoSecureStoragePreferences.swift

@@ -0,0 +1,23 @@
+//
+// Copyright Amazon.com Inc. or its affiliates.
+// All Rights Reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+import Foundation
+import Amplify
+
+/// A struct to store preferences for how the plugin uses storage
+public struct AWSCognitoSecureStoragePreferences {
+
+    /// The access group that the keychain will use for auth items
+    public let accessGroup: AccessGroup?
+
+    /// Creates an intstance of AWSCognitoSecureStoragePreferences
+    /// - Parameters:
+    ///   - accessGroup: access group to be used
+    public init(accessGroup: AccessGroup? = nil) {
+        self.accessGroup = accessGroup
+    }
+}