The app pairs with an idp.global web session, stores a trusted passport device identity, loads approval requests and alerts from the live backend, and signs approvals from Apple devices.

Issue Reporting and Security

For reporting bugs, issues, or security vulnerabilities, please visit community.foss.global/. This is the central community hub for all issue reporting. Developers who sign and comply with our contribution agreement and go through identification can also get a code.foss.global/ account to submit Pull Requests directly.

What It Does

Links an Apple device to an idp.global account through QR pairing, manual payload paste, or NFC pairing on supported iPhones.
Generates and stores passport signing key material for trusted-device requests.
Completes passport enrollment against the live completePassportEnrollment typed request.
Registers for APNs on iOS and uploads the device token through the signed registerPassportPushToken request, so pending challenges arrive as push notifications; notification taps refresh and open the inbox.
Loads the passport dashboard with profile, devices, pending challenges, and alerts.
Approves or rejects passport challenges by signing backend-provided challenge payloads.
Adds location evidence when a request requires it and NFC/GPS signed position evidence when pairing through NFC.
Provides iPhone compact navigation, iPad split navigation, macOS menu-bar UI, Apple Watch companion UI, and widget targets from one Xcode project.
Keeps MockIDPService available for previews and tests while normal runtime uses LiveIDPService.

Repository Layout

Path	Purpose
`package.json`	pnpm scripts for `@git.zone/tsswift`
`.smartconfig.json`	tsswift scheme, platform, simulator, derived-data, and remote-builder configuration
`swift/IDPGlobal.xcodeproj`	Xcode project
`swift/Sources/`	Main SwiftUI app source
`swift/WatchApp/`	Apple Watch app and widget source
`swift/Tests/`	Swift tests

App Architecture

Area	Key Files
App bootstrap	`swift/Sources/App/IDPGlobalApp.swift`, `swift/Sources/App/AppViewModel.swift`
Live backend client	`swift/Sources/Core/Services/MockIDPService.swift` (`LiveIDPService`, `LiveTypedRequestClient`)
Pairing	`LoginRootView.swift`, `QRScannerView.swift`, `NFCPairingView.swift`, `PairingPayloadParser.swift`
Dashboard	`HomeRootView.swift`, `HomePanels.swift`, `HomeCards.swift`, `HomeSheets.swift`
Persistence	`AppStateStore.swift`
Design system	`AppTheme.swift`, `Core/Design/`, `WatchApp/Design/`

Pairing And Approval Flow

Start a passport pairing flow from the idp.global web session you want to trust.
Scan the QR payload, paste it manually, or read it through NFC on supported iPhones.
The app parses the payload, derives the server URL, creates or loads local passport key material, signs the enrollment payload, and calls completePassportEnrollment.
After pairing, the app calls getPassportDashboard to load profile, devices, pending challenges, and alerts.
Approval requests are signed locally and sent through approvePassportChallenge; rejections use signed device requests against rejectPassportChallenge.

tsswift Setup

This repo is configured for tsswift from the repo root and expects a named global remote macOS builder.

Install tooling:

pnpm install

Configure a global remote macOS builder once:

pnpm exec tsswift config -g add-builder \
  --name <builder-name> \
  --host <ssh-host> \
  --root-dir <remote-project-root> \
  --platforms macos,ios,ipad

The global builder registry lives at:

~/.git.zone/tsswift/config.json

Verify it with:

pnpm exec tsswift config -g list-builders
pnpm exec tsswift config show
pnpm swift:doctor

Remote Builder Behavior

This project does not keep per-repo SSH details inside .smartconfig.json. It references a named builder, and tsswift resolves that builder from the global registry in ~/.git.zone/tsswift/config.json.

How it works:

tsswift syncs the repo to the configured remote project root via rsync.
xcodebuild, simctl, and simulator boot or launch commands execute on the remote macOS builder over SSH.
The local machine orchestrates the workflow; Apple platform builds happen on the builder.
Simulator builds are pinned to the builder machine's native architecture.
The selected simulator is opened by the requested device identifier instead of reviving a previously used simulator.

Current project defaults:

default scheme: IDPGlobal
default configuration: Debug
default run platform: macos
build platforms: macos, ios, ipad
test platform: macos
preferred iPhone simulator: iPhone 17 Pro
preferred iPad simulator: iPad mini (A17 Pro)
derived data path: swift/.build/xcode-derived-data
remote builder name: central-macos

Common Commands

From the repo root:

pnpm swift:doctor
pnpm swift:emulators
pnpm swift:build
pnpm swift:build:macos
pnpm run swift:build -- --platform ios
pnpm run swift:build -- --platform ipad
pnpm swift:test
pnpm run swift:run -- --platform ios
pnpm run swift:run -- --platform ipad
pnpm swift:watch

Notes:

swift:build builds the configured macOS, iPhone, and iPad matrix.
swift:test runs the macOS test target.
swift:run without extra flags follows the configured default platform, currently macos.
swift:run -- --platform ios boots the configured remote iPhone simulator, installs the app, and launches it.
swift:run -- --platform ipad does the same for the configured remote iPad simulator.

App Store Release State

Binary-side readiness (in this repo):

Marketing version 1.0.0, bundle global.idp.app, category productivity.
swift/PrivacyInfo.xcprivacy privacy manifest (precise location + device label collection for app functionality, no tracking; UserDefaults reason CA92.1) bundled into the app target.
ITSAppUsesNonExemptEncryption = NO (standard Apple CryptoKit crypto only) and NSSupportsLiveActivities = YES in the generated Info.plist.
Device entitlements (swift/IDPGlobal.entitlements, iphoneos SDK): aps-environment, app group group.global.idp.app, NFC NDEF reader. Distribution signing switches aps-environment to production.
Camera, NFC, and when-in-use location usage descriptions are set; the debug-only "Simulate Incoming Request" control is compiled out of Release builds.
Full icon set for iPhone, iPad, and macOS in swift/Assets.xcassets.

Remaining steps that need App Store Connect / an Apple Developer account:

Create the app record for global.idp.app (plus watch bundle ids) in App Store Connect and set the signing team on all targets.
Create an APNs auth key, upload nothing to Apple, and provision PASSPORT_APNS_KEY_ID, PASSPORT_APNS_TEAM_ID, and PASSPORT_APNS_PRIVATE_KEY in the idp.global production environment so the backend can deliver challenge pushes.
Archive the IDPGlobal scheme in Xcode (Release), validate, and upload through the Organizer or xcodebuild -exportArchive; run a TestFlight round first.
Fill privacy nutrition labels matching PrivacyInfo.xcprivacy (precise location + identifiers, app functionality, no tracking), age rating, support URL, and privacy policy URL.
Provide App Review with a demo idp.global account and a pairing walkthrough (reviewers need a second browser session showing the pairing QR at idp.global).
Capture screenshots (6.9" and 6.5" iPhone, 13" iPad, watch when submitting the watch app).

Direct Xcode Use

If you are working directly on a Mac instead of through tsswift, open:

swift/IDPGlobal.xcodeproj

Useful targets and schemes:

IDPGlobal for the main app
IDPGlobalWatch for the watch app
IDPGlobalWidgets for widgets

License and Legal Information

This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the license file.

Please note: The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.

Trademarks

This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH or third parties, and are not included within the scope of the MIT license granted herein.

Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines or the guidelines of the respective third-party owners, and any usage must be approved in writing. Third-party trademarks used herein are the property of their respective owners and used only in a descriptive manner, e.g. for an implementation of an API or similar.

readme.md

idp.global Swift App