This project forces me to build some of the most advanced UIs I've ever built, and I enjoy it so much.
* A text editor is also quite advanced, but not in the UI, really, it's more in the internals.
I've been profiling my app with the SwiftUI template in Instruments a lot over the past week.
I'm at the point where none of the long view body updates relate to my code but mostly to SwiftUI internals.
Most of these updates are caused by @Observable WindowAppearanceModel, which isn't my code. I don't know how I'm supposed to address this.
Have anyone replicated Shortcuts’ transition that changes the zoom destination based on state?
If the shortcut is empty, it zooms back to the “+” button but if actions are added, it zooms into the new item.
I’ve tried naive approaches with matchedTransitionSource(…) and navigationTransition(.zoom(…)) but none seem to work.
About to build a “mosaic” layout in SwiftUI where the size of the views will depend on the properties of the model they represent. Some views will fill the entire screen, and some will be sized to show two-by-two.
If this turns out well, this will be the first thing people see when they open my new app 😀🤞
Seems like the tricky part is figuring out how I can introduce a concept of sections when using SwiftUI’s Layout protocol to place views on the screen 🤔
I know how to do this with a UICollectionViewFlowLayout but I’d like to do it in SwiftUI.
Getting here has taken longer than usual. Normally, I rush to get the core flow working end-to-end so I can verify everything, and then polish later.
But this project was different. From early prototypes, I knew the technical side would work. The real challenge was designing an interface that felt good enough that I’d actually want to use it. It slowed things down, but I’m glad I did it.
Still a few somewhat big features left before I can release this project. Payments is one of them.
I think this will be my first subscription app. My guess is it’ll require a non-negligible amount of changes and testing with every major iOS release, and to make that sustainable, subscriptions feel like the right model.
Looking forward to diving into the subscription APIs in StoreKit… though I’ve heard they can be a bit daunting 😅
Torn between going with Sign in with Apple, or chasing a secure no-signup way to associate push tokens with a user’s devices using CloudKit
(a la https://www.swiftjectivec.com/how-to-use-icloud-without-really-using-icloud/).
Part of me really doesn’t want any kind of account in the app, even if it’s optional or delayed. But I also want something that’s secure and maintainable… which is exactly what Sign in with Apple promises to be.
Trade-offs everywhere. Curious how others have approached this.
A “no account” solution based on CloudKit could look like this:
1. Device fetches S, a user-specific secret, from the user’s private CloudKit DB, creating it if missing.
2. Device authenticates with
HMAC_SHA256(S, token || deviceId || timestamp || nonce)
3. On first registration, the backend learns S and then groups devices by
userId = SHA256(S), verifying the HMAC and rejecting replays via timestamp and nonce.
This proves knowledge of S, and therefore access to the user’s private CloudKit DB.
I’m experimenting with CloudKit’s public database for user-specific data but it makes my brain itch that it’s called “public”.
I’m pretty sure I’m using it as intended though. Access is scoped, records are tied to the user’s iCloud account, and nothing is actually truly public.
If this holds up, it’s nice. I already sync data in the user’s private database with SwiftData, and this gives me a way to share auxiliary user-bound data with a backend service via CloudKit’s server-to-server support.
@simonbs Oh nice! Good to know! Yeah I tried to build directly on CloudKit a while ago and gave up when I saw the shopping list of reasons it gives for when a sync operation fails.
I’ll give CKSyncEngine a proper try too then!
@john I haven’t tested it, but I think you can do this by setting `openURL` to a Shortcuts URL scheme when sending a notification with brrr.
You’d have to manually supply the arguments through the query parameters when sending the notification, so it’s not “use the notification as input” but rather “supply an explicit input”, which may be even better.
@simonbs I could see a big potential in the dating app grrr, fingers crossed it’s that side project!
Congrats on submitting.
@simonbs not really what you are asking but I ask for an email address, send a totp 6 digit code to the user’s email address, and use that for auth (via the web, returning a jwt, etc).
It’s not 2fa, but it’s simple, doesn’t require storing user-provided passwords, and doesn’t rely on potentially changeable apple authentication mechanisms.
@pfandrade My main concern is that I need to do a mapping in my service between CloudKit user record IDs and push tokens. Unless I properly secure this, anyone with access to the user record ID can register their own devices, making them receive private push notifications.
Therefore, I need to add some layer of security on top of this so a CloudKit user record ID isn't sufficient. Proving that's actually safe is tricky.
@simonbs let the app create the device token records on a public database, protect this table so only the creator and you have read access. Look at each row’s creator user id to know who it belongs to. Add another column with the user id itself if you need to search.
Seems secure enough for me.
Add logic to remove stale device tokens when APNS tells you so.
@simonbs you can use CloudKit web services:
With an API key generated in the CloudKit dashboard. The user generating the API key is the one you must ensure has read permission to that push tokens table.
@pfandrade This is really interesting to me. I didn’t know about this.
Sorry to pick your brain so much, but I can’t seem to find a way to give a server-to-server key s security role. Do you know if that’s possible or it can always access anything in the public database?