| 1 | <?xml version="1.0" encoding="UTF-8"?> |
| 2 | <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> |
| 3 | <plist version="1.0"> |
| 4 | <dict> |
| 5 | <!-- The ship entitlements the scaffold build deferred: sandbox on, real |
| 6 | keychain group, communication notifications. The restricted ones |
| 7 | (keychain group, communication) ride the provisioning profile that |
| 8 | automatic signing embeds at archive time. Existing installs keep their |
| 9 | identity across this change: Keychain.swift always used the |
| 10 | data-protection keychain and reads group-first-then-ungrouped, and |
| 11 | everything the app keeps on disk is a rebuildable cache. --> |
| 12 | <key>com.apple.security.app-sandbox</key> |
| 13 | <true/> |
| 14 | <key>com.apple.security.network.client</key> |
| 15 | <true/> |
| 16 | <!-- read-write: attachment uploads read picked files; "Save" panels write |
| 17 | downloads — both user-initiated through the powerbox. --> |
| 18 | <key>com.apple.security.files.user-selected.read-write</key> |
| 19 | <true/> |
| 20 | <!-- Saving an attachment writes to the REAL ~/Downloads. Without this, |
| 21 | FileManager's .downloadsDirectory silently resolves to the sandbox |
| 22 | container's own Downloads (~/Library/Containers/…/Data/Downloads), so |
| 23 | every "save" lands somewhere the member never looks and the Finder |
| 24 | reveal opens a folder that isn't theirs — the feed's file download |
| 25 | (NativeFeedView.save) and the media view's Save both did exactly that |
| 26 | until this line existed. --> |
| 27 | <key>com.apple.security.files.downloads.read-write</key> |
| 28 | <true/> |
| 29 | <!-- Same app-family group as iOS: the saved-instances store |
| 30 | (LChatCore/Keychain.swift) writes here once the entitlement exists. --> |
| 31 | <key>keychain-access-groups</key> |
| 32 | <array> |
| 33 | <string>$(AppIdentifierPrefix)com.elevenmessenger.messenger.shared</string> |
| 34 | </array> |
| 35 | <!-- Same app group as iOS. Two on-device caches resolve into this container |
| 36 | (containerURL returns the path on macOS whether or not the entitlement |
| 37 | exists, so a sandboxed build WITHOUT it has all access silently denied): |
| 38 | SharedAvatarCache — every avatar read/write is denied, banners fall back |
| 39 | to the monogram forever (#474); and MessageStore's local SQLite/FTS index |
| 40 | (LChatCore/MessageStore.swift, storeDir) — the store can't open, so |
| 41 | message search returns nothing while the feed still renders (#1121). The |
| 42 | Mac App ID needs the App Groups capability so the embedded profile |
| 43 | authorizes the group (unprovisioned group access prompts on macOS 15+). --> |
| 44 | <key>com.apple.security.application-groups</key> |
| 45 | <array> |
| 46 | <string>group.com.elevenmessenger.messenger</string> |
| 47 | </array> |
| 48 | <!-- Communication notifications: banner restyle via INSendMessageIntent — |
| 49 | sender's photo/monogram as the icon (CommunicationNotification.swift). --> |
| 50 | <key>com.apple.developer.usernotifications.communication</key> |
| 51 | <true/> |
| 52 | <!-- Universal links (docs/native-onboarding.md E.2, #1376): clicking an |
| 53 | https /join link on a covered domain opens the Mac app directly |
| 54 | instead of riding the elevenmessenger:// custom-scheme handoff. Same |
| 55 | domain set as iOS (LChat.entitlements — Apple's rule: every domain |
| 56 | named in the shipped binary, so custom domains keep the web join page |
| 57 | + its "Open in the app" button). Inert until the server half deploys: |
| 58 | the AASA names the Mac app id since PR #1383 (main.go serveAASA). --> |
| 59 | <key>com.apple.developer.associated-domains</key> |
| 60 | <array> |
| 61 | <string>applinks:*.elevenmessenger.com</string> |
| 62 | <string>applinks:11ch.at</string> |
| 63 | <string>applinks:*.11ch.at</string> |
| 64 | </array> |
| 65 | <!-- Sparkle under the sandbox: the running app must connect to the |
| 66 | installer's status (-spks) and installer (-spki) mach services, or |
| 67 | every update dies at "An error occurred while running the updater" — |
| 68 | SUEnableInstallerLauncherService alone only launches Installer.xpc; |
| 69 | these exceptions let the app talk to it (Sparkle's sandboxing docs). |
| 70 | Missing since sandboxing landed (#474), so no 0.5.0+ build could |
| 71 | self-update; the fix only arms builds that CONTAIN it, hence the |
| 72 | one-time manual install to 0.7.3. --> |
| 73 | <key>com.apple.security.temporary-exception.mach-lookup.global-name</key> |
| 74 | <array> |
| 75 | <string>$(PRODUCT_BUNDLE_IDENTIFIER)-spks</string> |
| 76 | <string>$(PRODUCT_BUNDLE_IDENTIFIER)-spki</string> |
| 77 | </array> |
| 78 | </dict> |
| 79 | </plist> |
| 80 | |
amadan