From 837786f4d95e7c4c079bc98622a0f7633049b59b Mon Sep 17 00:00:00 2001 From: Christophe Vila Date: Sat, 19 Sep 2026 15:47:22 +0200 Subject: [PATCH] docs: resolve remaining open questions in design spec Research confirmed macOS AutoFill has no real scope reduction vs iOS (same API, same app-or-website coverage) beyond requiring manual per-platform enablement, and that Associated Domains is the responsibility of the app being logged into, not the password manager's extension -- MyPass's existing CredentialMatcher already handles both domain- and bundle-ID-based serviceIdentifiers correctly. Adds an onboarding note since enabling the extension can't be automated on either platform. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01WYqycDFsynHH9VnnK7LNSf --- docs/superpowers/specs/2026-05-21-mypass-design.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/docs/superpowers/specs/2026-05-21-mypass-design.md b/docs/superpowers/specs/2026-05-21-mypass-design.md index 0bc9272..ee4f869 100644 --- a/docs/superpowers/specs/2026-05-21-mypass-design.md +++ b/docs/superpowers/specs/2026-05-21-mypass-design.md @@ -176,6 +176,10 @@ Keyboard shortcuts: `⌘C` copies password, `⌘⌥C` copies TOTP code, `⌘E` o 5. `CredentialListView` displays entries filtered by matching the `serviceIdentifier` URL/domain against each entry's URL field. Search bar allows manual lookup across all entries 6. User taps an entry → `completeRequest(withSelectedCredential: ASPasswordCredential(user:password:))` → field filled → extension dismissed +### Onboarding + +Neither iOS nor macOS allows the extension to be pre-enabled — the user must turn it on manually (Settings → Passwords → AutoFill Passwords on iOS; System Settings → Extensions on macOS). The main app's first-launch flow should detect this and prompt the user with a deep link to the relevant settings screen. + ### URL matching Entry URL field is matched against the `serviceIdentifier` using host comparison (e.g. `github.com` matches `https://github.com/login` and bundle ID-based identifiers via Associated Domains). Entries with no URL are shown in a separate "All entries" section below suggestions. @@ -237,5 +241,5 @@ Entry URL field is matched against the `serviceIdentifier` using host comparison ## Open Questions 1. ~~**KDBX library:** Evaluate Swift Package Manager options that support KDBX 3.1 + 4.0 with Argon2. Fallback: KeePassKit (Objective-C via bridging header).~~ **Resolved:** no SPM-native option was found; KeePassKit is used, vendored locally (see External dependencies above). -2. **macOS AutoFill:** `ASCredentialProviderExtension` on macOS 13+ has reduced scope vs iOS — verify which apps support third-party fill on macOS and document limitations. -3. **Associated Domains:** For bundle-ID-based AutoFill matching, an associated domains file may be needed for first-party apps. Evaluate at implementation time. +2. ~~**macOS AutoFill:** `ASCredentialProviderExtension` on macOS 13+ has reduced scope vs iOS — verify which apps support third-party fill on macOS and document limitations.~~ **Resolved:** no scope reduction found. Same `ASCredentialProviderViewController` API and "app or website" coverage as iOS. The only difference is enablement — the user must turn the extension on manually (System Settings → Extensions on macOS, Settings → Passwords → AutoFill on iOS); neither platform allows pre-enabling it via MDM/config profile. Onboarding should prompt the user to do this on first launch, on both platforms. +3. ~~**Associated Domains:** For bundle-ID-based AutoFill matching, an associated domains file may be needed for first-party apps. Evaluate at implementation time.~~ **Resolved: not applicable.** Associated Domains is the responsibility of the app *being logged into* (so the system can pass a domain-based `serviceIdentifier` instead of a bundle-ID one) — not the password manager. MyPass already handles both cases correctly: `CredentialMatcher` just matches whatever `serviceIdentifier` the system supplies against stored entry URLs, the same approach 1Password/Bitwarden use. No work needed.