[Auth] Fixed macOS extension keychain access by adding recommended kS…

[kamilpowalowski]

Fixes #8950, #6876

I'm working on the app that used Firebase Auth for authentication. I have an iOS app with iOS Share Extension and macOS app with macOS Share Extension.
By adding Keychain Access Group, I can use authenticated accounts between the main iOS app and iOS Share Extension. But the same code doesn't work on macOS.
When the app is installed on macOS or when I'm trying to access it from macOS Share Extension, I always get a prompt to keychain access. I started to dig, and I found the keychain parameter https://developer.apple.com/documentation/security/ksecusedataprotectionkeychain
from its documentation, we can find

use the data protection key when adding, searching for, or deleting an item to which the kSecAttrAccessible or kSecAttrAccessGroup attributes apply.

It's highly recommended that you set the value of this key to true for all keychain operations. This key helps to improve the portability of your code across platforms.

It can be added to all platforms:

The data protection key affects operations only in macOS. Other platforms automatically behave as if the key is set to true, and ignore the key in the query dictionary. You can safely use the key on all platforms.

kSecUseDataProtectionKeychain key is also mentioned in https://developer.apple.com/documentation/security/ksecattraccessgroup documentation

This attribute applies to macOS keychain items only if you also set a value of true for the kSecUseDataProtectionKeychain key, the kSecAttrSynchronizable key, or both.

But I have to limit it a bit with @available parameter.

I took screenshot from keychain without that key (only main app listed)

and a screenshot from keychain after key added (KeychainGroup access instead is listed)

[ncooke3]

Thanks a lot for the investigation and contribution @kamilpowalowski! I've approved the CI workflows.

Have you completed the Google CLA?

[kamilpowalowski]

@ncooke3 No problem :) I need that for my own app so I was motivated.

Yes, I completed Google CLA yesterday.

[ncooke3]

LGTM. I added one request below. Thanks again @kamilpowalowski!

[rosalyntan]

Thank you for the contribution! One minor comment, and there's a new merge conflict in the changelog that needs to be resolved before merging this, but otherwise LGTM!

[nidegen]

@kamilpowalowski do you have an idea by any chance if this would also fix a similar bug on tvOS?

[kamilpowalowski]

@nidegen, I don’t think so. It fixes a behavior related strictly to macOS. On macOS, you have access to the whole keychain. On other systems, you shouldn't have that problems. But (if possible) you should try to set shareAuthStateAcrossDevices to true. It may solve your problem.