crossmate

NYTAuthService.swift (12151B)

---

 import Foundation
 import Security
 import UIKit
 import WebKit
 
 enum NYTSessionState: Equatable {
     case unknown
     case signedOut
     case signedIn(email: String?)
 }
 
 enum NYTCookieLoadResult: Equatable, Sendable {
     case available(String)
     case missing
     case temporarilyUnavailable
 }
 
 @MainActor @Observable
 final class NYTAuthService {
     private(set) var sessionState: NYTSessionState = .unknown
     private(set) var isLoading = false
     var errorMessage: String?
     private let log: ((String) -> Void)?
 
     nonisolated private static let emailKey = "nyt-email"
     nonisolated private static let cookieKey = "nyt-cookie"
 
     init(log: ((String) -> Void)? = nil) {
         self.log = log
     }
 
     /// Thread-safe read of the stored NYT cookie for use from non-MainActor contexts.
     nonisolated static func currentCookie() -> String? {
         guard case .available(let cookie) = currentCookieResult() else { return nil }
         return cookie
     }
 
     /// Thread-safe read of the stored NYT cookie that preserves transient keychain failures.
     nonisolated static func currentCookieResult() -> NYTCookieLoadResult {
         cookieLoadResult(from: KeychainHelper.loadWithStatus(key: cookieKey))
     }
 
     static let loginURL = URL(string: "https://myaccount.nytimes.com/auth/login?response_type=cookie&client_id=games&redirect_uri=https%3A%2F%2Fwww.nytimes.com%2Fcrosswords")!
 
     func loadStoredSession() {
         let cookieResult = KeychainHelper.loadWithStatus(key: Self.cookieKey)
         logCookieKeychainLoad(result: cookieResult)
 
         switch Self.cookieLoadResult(from: cookieResult) {
         case .available(let cookie):
             migrateCookieAccessibility(cookie)
             sessionState = .signedIn(email: storedEmail())
         case .missing:
             sessionState = .signedOut
         case .temporarilyUnavailable:
             sessionState = .unknown
         }
     }
 
     /// Called by the web login view after the user completes sign-in and the
     /// WKWebView navigates to the redirect URL. Extracts the NYT-S cookie
     /// from the provided cookie store.
     func completeSignIn(cookieStore: WKHTTPCookieStore) async {
         isLoading = true
         errorMessage = nil
         defer { isLoading = false }
 
         do {
             let cookies = await cookieStore.allCookies()
 
             print("=== COOKIES FROM WEBVIEW ===")
             for cookie in cookies {
                 print("\(cookie.name) (domain: \(cookie.domain))")
             }
             print("=== END COOKIES ===")
 
             guard let nytsCookie = cookies.first(where: { $0.name == "NYT-S" }) else {
                 throw NYTAuthError.missingCookie
             }
 
             let cookieValue = nytsCookie.value
             let email = try await fetchUserEmail(cookies: cookies)
 
             try KeychainHelper.save(
                 key: Self.cookieKey,
                 data: Data(cookieValue.utf8)
             )
             if let email {
                 try KeychainHelper.save(
                     key: Self.emailKey,
                     data: Data(email.utf8)
                 )
             } else {
                 KeychainHelper.delete(key: Self.emailKey)
             }
             sessionState = .signedIn(email: email)
         } catch {
             errorMessage = error.localizedDescription
         }
     }
 
     func signOut() {
         KeychainHelper.delete(key: Self.emailKey)
         KeychainHelper.delete(key: Self.cookieKey)
         sessionState = .signedOut
         errorMessage = nil
     }
 
     var cookie: String? {
         Self.currentCookie()
     }
 
     var isSignedIn: Bool {
         if case .signedIn = sessionState { return true }
         return false
     }
 
     var signedInEmail: String? {
         if case .signedIn(let email) = sessionState { return email }
         return nil
     }
 
     var canAttemptNYTFetch: Bool {
         sessionState != .signedOut
     }
 
     var sessionStatusMessage: String? {
         switch sessionState {
         case .unknown:
             "Crossmate could not determine whether you are signed in to NYT. Unlock the device and try again."
         case .signedOut, .signedIn:
             nil
         }
     }
 
     // MARK: - Private
 
     private func logCookieKeychainLoad(
         result: (data: Data?, status: OSStatus)
     ) {
         log?(
             "NYT session cookie keychain load: status=\(Self.keychainStatusDescription(result.status)) " +
                 "hasData=\(result.data != nil)"
         )
     }
 
     nonisolated private static func keychainStatusDescription(_ status: OSStatus) -> String {
         if status == errSecSuccess {
             return "success(0)"
         }
         if status == errSecItemNotFound {
             return "itemNotFound(\(status))"
         }
         let message = SecCopyErrorMessageString(status, nil) as String?
         if let message, !message.isEmpty {
             return "\(message)(\(status))"
         }
         return "OSStatus(\(status))"
     }
 
     nonisolated static func sessionState(
         forCookieLoadResult result: NYTCookieLoadResult,
         email: String? = nil
     ) -> NYTSessionState {
         switch result {
         case .available:
             .signedIn(email: email)
         case .missing:
             .signedOut
         case .temporarilyUnavailable:
             .unknown
         }
     }
 
     nonisolated private static func cookieLoadResult(
         from result: (data: Data?, status: OSStatus)
     ) -> NYTCookieLoadResult {
         guard result.status == errSecSuccess,
               let data = result.data,
               let cookie = String(data: data, encoding: .utf8),
               !cookie.isEmpty else {
             return result.status == errSecInteractionNotAllowed
                 ? .temporarilyUnavailable
                 : .missing
         }
         return .available(cookie)
     }
 
     private func storedEmail() -> String? {
         let emailResult = KeychainHelper.loadWithStatus(key: Self.emailKey)
         guard let emailData = emailResult.data,
               let email = String(data: emailData, encoding: .utf8),
               !email.isEmpty else {
             return nil
         }
         return email
     }
 
     private func migrateCookieAccessibility(_ cookie: String) {
         do {
             try KeychainHelper.save(key: Self.cookieKey, data: Data(cookie.utf8))
         } catch {
             log?("NYT session cookie keychain migration failed: \(error)")
         }
     }
 
     private func fetchUserEmail(cookies: [HTTPCookie]) async throws -> String? {
         let cookieHeader = Self.cookieHeader(for: cookies)
         guard let configuration = try await fetchAccountGraphQLConfiguration(
             cookieHeader: cookieHeader
         ) else {
             return nil
         }
 
         var request = URLRequest(url: configuration.url)
         request.httpMethod = "POST"
         request.setValue(cookieHeader, forHTTPHeaderField: "Cookie")
         request.setValue("application/json", forHTTPHeaderField: "Accept")
         request.setValue("application/json", forHTTPHeaderField: "Content-Type")
         for header in configuration.headers {
             request.setValue(header.value, forHTTPHeaderField: header.key)
         }
         request.httpBody = try JSONSerialization.data(withJSONObject: [
             "operationName": "UserQuery",
             "variables": [:],
             "query": """
             query UserQuery {
               user {
                 profile {
                   displayName
                   email
                   givenName
                   familyName
                 }
                 userInfo {
                   regiId
                   entitlements
                 }
               }
             }
             """
         ])
 
         let (data, response) = try await URLSession.shared.data(for: request)
         guard let httpResponse = response as? HTTPURLResponse,
               httpResponse.statusCode == 200 else {
             return nil
         }
 
         return Self.extractEmail(from: data)
     }
 
     private func fetchAccountGraphQLConfiguration(
         cookieHeader: String
     ) async throws -> AccountGraphQLConfiguration? {
         var request = URLRequest(url: URL(string: "https://myaccount.nytimes.com")!)
         request.setValue(cookieHeader, forHTTPHeaderField: "Cookie")
         request.setValue("text/html", forHTTPHeaderField: "Accept")
 
         let (data, response) = try await URLSession.shared.data(for: request)
         guard let httpResponse = response as? HTTPURLResponse,
               httpResponse.statusCode == 200,
               let html = String(data: data, encoding: .utf8) else {
             return nil
         }
 
         return Self.extractAccountGraphQLConfiguration(from: html)
     }
 
     nonisolated static func extractEmail(from data: Data) -> String? {
         guard let response = try? JSONDecoder().decode(UserQueryResponse.self, from: data),
               let email = response.data.user.profile?.email,
               !email.isEmpty else {
             return nil
         }
         return email
     }
 
     nonisolated static func extractAccountGraphQLConfiguration(
         from html: String
     ) -> AccountGraphQLConfiguration? {
         guard let urlString = firstJSONStringValue(named: "gqlUrlClient", in: html),
               let url = URL(string: urlString),
               let appType = firstJSONStringValue(named: "nyt-app-type", in: html),
               let appVersion = firstJSONStringValue(named: "nyt-app-version", in: html),
               let token = firstJSONStringValue(named: "nyt-token", in: html) else {
             return nil
         }
 
         return AccountGraphQLConfiguration(
             url: url,
             headers: [
                 "nyt-app-type": appType,
                 "nyt-app-version": appVersion,
                 "nyt-token": token
             ]
         )
     }
 
     nonisolated private static func cookieHeader(for cookies: [HTTPCookie]) -> String {
         cookies
             .filter { cookie in
                 cookie.domain.contains("nytimes.com")
                     || cookie.domain.contains("nyt.com")
             }
             .map { "\($0.name)=\($0.value)" }
             .joined(separator: "; ")
     }
 
     nonisolated private static func firstJSONStringValue(
         named name: String,
         in string: String
     ) -> String? {
         let escapedName = NSRegularExpression.escapedPattern(for: name)
         let pattern = #"""# + escapedName + #""\s*:\s*"((?:\\.|[^"\\])*)"#
         guard let regex = try? NSRegularExpression(pattern: pattern) else {
             return nil
         }
 
         let range = NSRange(string.startIndex..<string.endIndex, in: string)
         guard let match = regex.firstMatch(in: string, range: range),
               let valueRange = Range(match.range(at: 1), in: string) else {
             return nil
         }
 
         let rawValue = String(string[valueRange])
         let json = #"{"value":""# + rawValue + #""}"#
         guard let data = json.data(using: .utf8),
               let object = try? JSONSerialization.jsonObject(with: data) as? [String: String] else {
             return nil
         }
         return object["value"]
     }
 }
 
 struct AccountGraphQLConfiguration: Equatable {
     var url: URL
     var headers: [String: String]
 }
 
 private struct UserQueryResponse: Decodable {
     var data: UserQueryData
 }
 
 private struct UserQueryData: Decodable {
     var user: UserQueryUser
 }
 
 private struct UserQueryUser: Decodable {
     var profile: UserQueryProfile?
 }
 
 private struct UserQueryProfile: Decodable {
     var email: String?
 }
 
 enum NYTAuthError: LocalizedError {
     case invalidResponse
     case httpError(statusCode: Int)
     case missingCookie
     case serverError(String)
 
     var errorDescription: String? {
         switch self {
         case .invalidResponse:
             "Received an invalid response from the server."
         case .httpError(let statusCode):
             "Sign in failed (HTTP \(statusCode))."
         case .missingCookie:
             "Sign in succeeded but the session cookie was not returned."
         case .serverError(let message):
             message
         }
     }
 }