fix(mobile): configure iOS Keychain access group

[VedankPurohit]

Summary

• Adds explicit iOS Keychain access-group configuration for mobile app variants.
• Covers the development bundle identifier with a small Expo config regression test.
• Keeps credential storage on SecureStore; no insecure fallback storage is added.

The mobile app stores connection credentials through expo-secure-store, which uses the iOS Keychain. During iOS simulator pairing, SecureStore previously failed with:

Calling the 'getValueWithKeyAsync' function has failed
A required entitlement isn't present.

The Expo iOS config did not explicitly declare a bundle-scoped Keychain access group. This adds $(AppIdentifierPrefix)<bundle identifier> for each app variant.

Test plan

• vp run --filter @t3tools/mobile test -- app.config.test.ts
• vp run typecheck
• vp run lint:mobile
• vp check
• Built and installed the native iOS simulator app, paired with a local server, then relaunched and confirmed the saved environment loaded.

Notes

This app uses Expo native tooling/dev-client style builds, not Expo Go.

On this Xcode simulator setup, the installed simulator app still reports empty embedded entitlements because Xcode reports ENTITLEMENTS_ALLOWED = NO. The runtime pairing and SecureStore read-back flow was validated successfully.

---

Note

Low Risk
Narrow native signing/entitlement config change for Keychain; no new storage paths or auth logic.

Overview
Fixes iOS SecureStore failures during simulator pairing (getValueWithKeyAsync / missing entitlement) by declaring an explicit keychain-access-groups entitlement in Expo iOS config.

Each app variant gets $(AppIdentifierPrefix)<variant bundle id> so Keychain access matches the signed bundle; credential storage still goes through expo-secure-store only.

^{Reviewed by Cursor Bugbot for commit 2853524. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add keychain-access-groups entitlement to iOS builds

Adds ios.entitlements to app.config.ts with a keychain-access-groups entry set to $(AppIdentifierPrefix)<bundleIdentifier>. This configures the app to participate in the correct iOS keychain access group at runtime.

^{Macroscope summarized 2853524.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 39232b97-656d-4384-9682-9b139e1c4ad0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved

This is a standard iOS configuration change adding keychain-access-groups entitlement with the app's own bundle identifier. The change is declarative, follows standard patterns, and poses minimal risk.

^{You can customize Macroscope's approvability policy. Learn more.}

[VedankPurohit]

Context for the human review flagged above: the declared group $(AppIdentifierPrefix)<bundle identifier> is each app variant's own default Keychain access group, so this doesn't broaden access — it makes the implicit default explicit so SecureStore's Keychain calls stop failing during simulator pairing. The widget extension target only uses an App Group (com.apple.security.application-groups) and has never declared Keychain sharing, so no other target's access changes.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit b6cb69b. Configure here.}

[lnieuwenhuis]

Maintainer verification: the one-file entitlement change is the documented fix for the SecureStore access-group error and nothing else changes. Two things before merge: the base is ~2 months old and needs a rebase, and I noticed the group uses variant.iosBundleIdentifier rather than the resolved personal-team identifier — personal-team builds would get the non-personal group, though those builds already lose app-groups/push per the config comments. Please confirm production signing embeds the group per variant and re-validate pairing plus relaunch on a real device, not just the simulator.