User Authentication Flow

The User Authentication Flow in Social-Connect manages the secure storage, retrieval, and application of authentication tokens during network requests. It ensures that sensitive credentials remain protected within the system keychain while providing a seamless way for authorized services to interact with protected API endpoints.

This system acts as the foundation for user-specific actions, such as following or unfollowing users, by automatically injecting required credentials into outgoing network requests.

Sources: APIClient.swift, KeychainManager.swift, UserService.swift

Architecture Overview

The authentication architecture is composed of three primary layers: secure storage, network abstraction, and service implementation.

Secure Storage Layer

The KeychainManager serves as the interface for the iOS Security framework. It specifically handles the retrieval of the authToken stored as a generic password.

The diagram shows the interaction between the KeychainManager and the underlying iOS Keychain to retrieve credentials.
Sources: KeychainManager.swift:6-26

Network Abstraction Layer

The APIClient is responsible for constructing and executing HTTP requests. It interacts with the KeychainManager to check for an existing token. If a token is found, it is added to the "Authorization" header using the Bearer scheme.

Sources: APIClient.swift:4-21

Token Injection Sequence

When a service (like UserService) initiates a request, the APIClient automatically handles the authentication state.

This sequence illustrates how the APIClient mediates between the high-level services and the secure storage to authorize outgoing requests.
Sources: APIClient.swift:15-32, UserService.swift:8-15

Implementation Details

Keychain Retrieval logic

The system utilizes a specific query dictionary to locate the authentication token within the keychain. It filters by the account attribute named "authToken".

let query: [String: Any] = [
    kSecClass as String: kSecClassGenericPassword,
    kSecAttrAccount as String: "authToken",
    kSecReturnData as String: true,
    kSecMatchLimit as String: kSecMatchLimitOne
]

Sources: KeychainManager.swift:11-16

Request Authorization

In the APIClient.post method, the request is mutated to include the token only if KeychainManager.shared.getAuthToken() returns a non-nil value.

if let token = KeychainManager.shared.getAuthToken() {
    request.addValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
}

Sources: APIClient.swift:18-20

Integration with Services and Deep Links

Authentication is a prerequisite for most user interactions. The UserService leverages the authenticated APIClient to perform social actions. These actions can also be triggered via deep links, which are processed by the AppDelegate and passed to the DeepLinkHandler.

The diagram traces an external deep link trigger through the system to an authenticated API call.
Sources: AppDelegate.swift:14-17, DeepLinkHandler.swift:31-38, UserService.swift:8-15

Authenticated Actions Summary

The following table lists user actions that rely on the authentication flow:

Sources: UserService.swift:7-25

Conclusion

The User Authentication Flow provides a centralized and secure mechanism for managing identity within Social-Connect. By abstracting keychain interactions and automating header injection in the APIClient, the architecture ensures that services and deep link handlers can perform authorized operations without manually handling sensitive tokens.