Sean/trusted device sign in

Examples/Quickstart/Quickstart/Info.plist

@@ -15,6 +15,8 @@
 			</array>
 		</dict>
 	</array>
+	<key>NSFaceIDUsageDescription</key>
+	<string>Quickstart uses Face ID to sign you in.</string>
 	<key>NSLocalNetworkUsageDescription</key>
 	<string>Atlantis uses Bonjour Service to discover the Proxyman app on your local network.</string>
 	<key>NSBonjourServices</key>
@@ -23,4 +25,3 @@
 	</array>
 </dict>
 </plist>
-

Sources/ClerkKit/Core/Auth.swift

@@ -19,6 +19,7 @@ public struct Auth {
   private let signInService: SignInServiceProtocol
   private let signUpService: SignUpServiceProtocol
   private let sessionService: SessionServiceProtocol
+  private let trustedDevices: TrustedDevices
   private let eventEmitter: EventEmitter<AuthEvent>
   private let urlHandlingCoordinator: URLHandlingCoordinator
 
@@ -28,6 +29,7 @@ public struct Auth {
     signInService: SignInServiceProtocol,
     signUpService: SignUpServiceProtocol,
     sessionService: SessionServiceProtocol,
+    trustedDevices: TrustedDevices,
     eventEmitter: EventEmitter<AuthEvent>,
     urlHandlingCoordinator: URLHandlingCoordinator
   ) {
@@ -36,6 +38,7 @@ public struct Auth {
     self.signInService = signInService
     self.signUpService = signUpService
     self.sessionService = sessionService
+    self.trustedDevices = trustedDevices
     self.eventEmitter = eventEmitter
     self.urlHandlingCoordinator = urlHandlingCoordinator
   }
@@ -305,6 +308,26 @@ public struct Auth {
   }
   #endif
 
+  /// Signs in with a locally enrolled trusted-device credential.
+  ///
+  /// The trusted-device domain owns local credential selection, key access, challenge signing,
+  /// and stale local credential cleanup.
+  ///
+  /// - Parameters:
+  ///   - id: The trusted-device credential ID to use. When omitted, the available local credential is used.
+  ///   - identifierHint: A local-only user identifier hint used to choose a matching credential.
+  ///   - reason: The reason shown in the system biometric prompt.
+  /// - Returns: A `SignIn` object representing the trusted-device sign-in attempt.
+  /// - Throws: An error if trusted-device sign-in fails.
+  @discardableResult
+  public func signInWithTrustedDevice(
+    id: String? = nil,
+    identifierHint: String? = nil,
+    reason: String? = nil
+  ) async throws -> SignIn {
+    try await trustedDevices.signIn(id: id, identifierHint: identifierHint, reason: reason)
+  }
+
   #if !os(tvOS) && !os(watchOS)
   /// Starts Enterprise SSO and returns the prepared sign-in state.
   ///

Sources/ClerkKit/Core/AuthFlowRegistration.swift

@@ -0,0 +1,21 @@
+//
+//  AuthFlowRegistration.swift
+//  Clerk
+//
+
+import Foundation
+
+package final class AuthFlowRegistration: Sendable {
+  private let unregister: @MainActor @Sendable () -> Void
+
+  package init(unregister: @escaping @MainActor @Sendable () -> Void) {
+    self.unregister = unregister
+  }
+
+  deinit {
+    let unregister = unregister
+    Task { @MainActor in
+      unregister()
+    }
+  }
+}

Sources/ClerkKit/Core/Clerk+Installation.swift

@@ -0,0 +1,58 @@
+//
+//  Clerk+Installation.swift
+//  Clerk
+//
+
+import Foundation
+
+extension Clerk {
+  @MainActor
+  package static var installationMarkerUserDefaults: UserDefaults = .standard
+  @MainActor
+  package static var trustedDeviceAppIdentifierProvider: () -> String? = {
+    Bundle.main.bundleIdentifier
+  }
+
+  private static let trustedDeviceInstallationMarkerPrefix = "com.clerk.trusted-device-installation-marker"
+
+  @MainActor
+  package func reconcileTrustedDeviceCredentialsForCurrentInstallation() {
+    guard let appIdentifier = Self.trustedDeviceAppIdentifierProvider() else {
+      return
+    }
+
+    let markerKey = Self.trustedDeviceInstallationMarkerKey(
+      for: options.keychainConfig,
+      appIdentifier: appIdentifier
+    )
+    guard Self.installationMarkerUserDefaults.object(forKey: markerKey) as? Bool != true else {
+      return
+    }
+
+    do {
+      try dependencies.trustedDeviceCredentialStore
+        .deleteLocalCredentials(
+          appIdentifier: appIdentifier,
+          keyManager: dependencies.trustedDeviceKeyManager
+        )
+      Self.installationMarkerUserDefaults.set(true, forKey: markerKey)
+    } catch {
+      ClerkLogger.logError(
+        error,
+        message: "Failed to clear trusted-device local credentials for a new app installation."
+      )
+    }
+  }
+
+  private static func trustedDeviceInstallationMarkerKey(
+    for keychainConfig: Options.KeychainConfig,
+    appIdentifier: String
+  ) -> String {
+    [
+      trustedDeviceInstallationMarkerPrefix,
+      keychainConfig.service,
+      keychainConfig.accessGroup ?? "default",
+      appIdentifier,
+    ].joined(separator: ".")
+  }
+}

Sources/ClerkKit/Core/Clerk.swift

@@ -101,6 +101,20 @@ public final class Clerk {
     session?.user
   }
 
+  /// Whether Clerk currently has a user-backed active session.
+  private var hasActiveUserSession: Bool {
+    user != nil && session?.status == .active
+  }
+
+  /// Whether authentication and any Clerk-owned post-authentication steps are complete.
+  ///
+  /// Use this value when choosing between a root authentication view and authenticated content.
+  /// It becomes `true` when there is a current user, the current session is active, and a
+  /// non-dismissible `AuthView` is no longer completing a post-authentication step.
+  public var isAuthFlowComplete: Bool {
+    hasActiveUserSession && !isAuthFlowPending
+  }
+
   /// The current user's membership in the active organization.
   public var organizationMembership: OrganizationMembership? {
     guard let activeOrganizationId = session?.lastActiveOrganizationId else {
@@ -210,6 +224,34 @@ public final class Clerk {
   /// Callback-scoped auth continuation used internally by `AuthView` to resume recovered flows.
   package private(set) var callbackContinuation: TransferFlowResult?
 
+  /// The non-dismissible auth view currently managing authentication.
+  private var authFlowRegistrationId: UUID?
+
+  /// Whether that auth view is completing Clerk-owned post-authentication work.
+  private var isAuthFlowPending = false
+
+  /// The completed authentication result awaiting that view's post-authentication work.
+  package private(set) var pendingAuthFlowCompletion: TransferFlowResult?
+
+  /// The pending completion once its user-backed session is current and ready for post-auth work.
+  package var readyPendingAuthFlowCompletion: TransferFlowResult? {
+    guard let pendingAuthFlowCompletion else { return nil }
+
+    guard let createdSessionId = pendingAuthFlowCompletion.createdSessionId else {
+      return pendingAuthFlowCompletion
+    }
+
+    guard let session,
+          session.user != nil,
+          session.status == .active || session.status == .pending,
+          createdSessionId == session.id
+    else {
+      return nil
+    }
+
+    return pendingAuthFlowCompletion
+  }
+
   /// The main entry point for all authentication operations.
   ///
   /// Use this property to perform sign in, sign up, and session management operations.
@@ -221,6 +263,7 @@ public final class Clerk {
       signInService: dependencies.signInService,
       signUpService: dependencies.signUpService,
       sessionService: dependencies.sessionService,
+      trustedDevices: trustedDevices,
       eventEmitter: authEventEmitter,
       urlHandlingCoordinator: urlHandlingCoordinator
     )
@@ -230,13 +273,63 @@ public final class Clerk {
     callbackContinuation = result
   }
 
+  package func registerAuthFlow() -> AuthFlowRegistration? {
+    guard !hasActiveUserSession else { return nil }
+
+    let registrationId = UUID()
+    authFlowRegistrationId = registrationId
+    isAuthFlowPending = session?.status == .pending
+
+    return AuthFlowRegistration { [weak self] in
+      self?.unregisterAuthFlow(registrationId: registrationId)
+    }
+  }
+
+  package func markAuthFlowPending() {
+    guard authFlowRegistrationId != nil else { return }
+    isAuthFlowPending = true
+  }
+
+  package func markAuthFlowComplete() {
+    guard authFlowRegistrationId != nil else { return }
+    pendingAuthFlowCompletion = nil
+    isAuthFlowPending = false
+  }
+
+  package func consumePendingAuthFlowCompletion() {
+    pendingAuthFlowCompletion = nil
+  }
+
+  private func holdAuthFlowCompletion(_ result: TransferFlowResult) {
+    guard authFlowRegistrationId != nil else { return }
+    isAuthFlowPending = true
+    pendingAuthFlowCompletion = result
+  }
+
+  private func unregisterAuthFlow(registrationId: UUID) {
+    guard authFlowRegistrationId == registrationId else { return }
+    authFlowRegistrationId = nil
+    pendingAuthFlowCompletion = nil
+    isAuthFlowPending = false
+  }
+
   /// The main entry point for organization operations.
   ///
   /// Use this property to create organizations.
   public var organizations: Organizations {
     Organizations(organizationService: dependencies.organizationService)
   }
 
+  /// The main entry point for trusted-device credential operations.
+  public var trustedDevices: TrustedDevices {
+    TrustedDevices(
+      trustedDeviceService: dependencies.trustedDeviceService,
+      signInService: dependencies.signInService,
+      keyManager: dependencies.trustedDeviceKeyManager,
+      credentialStore: dependencies.trustedDeviceCredentialStore
+    )
+  }
+
   /// Proxy configuration derived from `proxyUrl`, if present.
   var proxyConfiguration: ProxyConfiguration? {
     dependencies.configurationManager.proxyConfiguration
@@ -290,6 +383,7 @@ extension Clerk {
     taskCoordinator = TaskCoordinator()
 
     self.dependencies = dependencies
+    reconcileTrustedDeviceCredentialsForCurrentInstallation()
 
     // Set up session polling and lifecycle management
     sessionPollingManager = SessionPollingManager(
@@ -583,6 +677,8 @@ extension Clerk {
     await SessionTokenFetcher.shared.reset()
     await SessionTokensCache.shared.clear()
 
+    pendingAuthFlowCompletion = nil
+    isAuthFlowPending = false
     client = nil
     environment = nil
     sessionsByUserId = [:]
@@ -771,7 +867,8 @@ extension Clerk {
     _ incoming: Client?,
     responseSequence: Int? = nil,
     serverDate: Date? = nil,
-    clientResponseGeneration: ClientResponseGeneration? = nil
+    clientResponseGeneration: ClientResponseGeneration? = nil,
+    completedAuthFlow: TransferFlowResult? = nil
   ) {
     if let clientResponseGeneration, clientResponseGeneration != self.clientResponseGeneration {
       ClerkLogger.debug(
@@ -797,6 +894,9 @@ extension Clerk {
     if let serverDate {
       lastClientServerFetchDate = serverDate
     }
+    if let completedAuthFlow {
+      holdAuthFlowCompletion(completedAuthFlow)
+    }
     client = incoming
   }