• pnpm-lock.yaml: Language not supported
• sdks/implementations/swift/Examples/StackAuthiOS/.swiftpm/xcode/package.xcworkspace/contents.xcworkspacedata: Language not supported

sdks/spec/src/types/notifications/notification-category.spec.md (1)

27-42: Clarify error and response behavior for subscribe/unsubscribe.

“Does not error” is likely inaccurate for authenticated POSTs (e.g., auth failure, invalid category_id, rate limits). Please document expected status codes and response shape, plus any error cases (even if idempotent).

sdks/implementations/swift/Sources/StackAuth/Models/Permission.swift (2)

4-11: Consider adding Codable, Equatable, and Hashable conformance.

These models will likely be deserialized from API responses and used in collections or comparisons. Adding these conformances improves usability.

Proposed enhancement

-public struct TeamPermission: Sendable {
+public struct TeamPermission: Sendable, Codable, Equatable, Hashable {
     public let id: String
+    
+    public init(id: String) {
+        self.id = id
+    }
 }

-public struct ProjectPermission: Sendable {
+public struct ProjectPermission: Sendable, Codable, Equatable, Hashable {
     public let id: String
+    
+    public init(id: String) {
+        self.id = id
+    }
 }

---

1-1: Foundation import may be unnecessary.

String is part of the Swift standard library. Unless other Foundation types are planned for this file, the import can be removed.

sdks/implementations/swift/Sources/StackAuth/Models/Project.swift (2)

9-11: Consider throwing on missing required fields instead of defaulting to empty strings.

Using empty string defaults for id and displayName silently masks API parsing failures. If the API returns malformed data, consumers won't know these fields are invalid until runtime issues occur.

♻️ Alternative: failable initializer

-    init(from json: [String: Any]) {
-        self.id = json["id"] as? String ?? ""
-        self.displayName = json["display_name"] as? String ?? ""
+    init?(from json: [String: Any]) {
+        guard let id = json["id"] as? String,
+              let displayName = json["display_name"] as? String else {
+            return nil
+        }
+        self.id = id
+        self.displayName = displayName

---

85-87: Consider adding a public initializer for OAuthProviderConfig.

Without a public initializer, consumers cannot create instances for testing or programmatic use.

♻️ Add public init

 public struct OAuthProviderConfig: Sendable {
     public let id: String
+    
+    public init(id: String) {
+        self.id = id
+    }
 }

sdks/implementations/swift/Sources/StackAuth/APIClient.swift (2)

76-76: Prefer non-optional Data initializer.

Per SwiftLint, "{}".data(using: .utf8) returns an optional. Use Data("{}".utf8) instead which is non-optional and cleaner.

♻️ Proposed fix

-            request.httpBody = "{}".data(using: .utf8)
+            request.httpBody = Data("{}".utf8)

---

250-256: JSON parsing swallows the underlying error.

Using try? loses the original parse error details, making debugging difficult. Consider preserving the error information.

♻️ Preserve parse error

     func parseJSON<T>(_ data: Data) throws -> T {
-        guard let json = try? JSONSerialization.jsonObject(with: data) as? T else {
-            throw StackAuthError(code: "parse_error", message: "Failed to parse response")
+        do {
+            guard let json = try JSONSerialization.jsonObject(with: data) as? T else {
+                throw StackAuthError(code: "parse_error", message: "Response type mismatch")
+            }
+            return json
+        } catch let error as StackAuthError {
+            throw error
+        } catch {
+            throw StackAuthError(code: "parse_error", message: "Failed to parse response: \(error.localizedDescription)")
         }
-        return json
     }

sdks/implementations/swift/Sources/StackAuth/Models/ContactChannel.swift (2)

14-22: Defensive parsing with empty string fallback for id could lead to invalid API calls.

If the JSON lacks an id field, self.id becomes "", resulting in API paths like /contact-channels/ which will fail or behave unexpectedly. Consider throwing an error or using a failable initializer when required fields are missing.

💡 Suggested approach

-    init(client: APIClient, json: [String: Any]) {
+    init?(client: APIClient, json: [String: Any]) {
+        guard let id = json["id"] as? String, !id.isEmpty else {
+            return nil
+        }
         self.client = client
-        self.id = json["id"] as? String ?? ""
+        self.id = id
         self.value = json["value"] as? String ?? ""
         self.type = json["type"] as? String ?? "email"
         self.isPrimary = json["is_primary"] as? Bool ?? false
         self.isVerified = json["is_verified"] as? Bool ?? false
         self.usedForAuth = json["used_for_auth"] as? Bool ?? false
     }

---

41-46: Silent failure on response parsing leaves local state stale.

If JSONSerialization fails or the response structure is unexpected, the local properties retain their old values without any indication of failure. This is consistent with other models in the SDK but may cause subtle bugs where the client believes the update succeeded while local state diverges from the server.

Consider logging a warning or documenting this behavior explicitly if intentional.

sdks/implementations/swift/Sources/StackAuth/Models/CurrentUser.swift (4)

287-298: URL query parameters should be URL-encoded.

team.id is directly interpolated into the URL without encoding. While team IDs are typically UUIDs, encoding ensures robustness.

💡 Suggested improvement

         if let team = team {
-            query.append("team_id=\(team.id)")
+            query.append("team_id=\(team.id.addingPercentEncoding(withAllowedCharacters: .urlQueryAllowed) ?? team.id)")
         }

Consider adding a helper method in APIClient for building query strings safely.

---

124-127: Inconsistent error handling: list methods silently return empty arrays on parse failure.

Methods like listTeams(), listContactChannels(), getActiveSessions(), listPermissions(), and listApiKeys() return empty arrays when JSON parsing fails, while createTeam(), createContactChannel(), and createApiKey() throw errors. This inconsistency could mask real issues (network errors that throw are fine, but a 200 response with malformed JSON silently returns []).

Consider either documenting this behavior or throwing parse errors consistently.

Also applies to: 179-182, 222-225, 306-309, 323-326

---

156-159: createTeam automatically selects the newly created team.

This side effect may be unexpected. Consider documenting this behavior or making it optional.

---

132-135: getTeam(id:) should use the direct team endpoint instead of fetching all teams.

This implementation fetches all user teams and filters client-side, which is inefficient for users with many teams. Use the direct endpoint /teams/{teamId} like StackServerApp.getTeam(id:) does (see line 150 in StackServerApp.swift).

sdks/implementations/swift/Tests/StackAuthTests/ContactChannelTests.swift (1)

87-111: Ensure server‑created users are always cleaned up.
If an assertion fails before the explicit delete, users can be left behind. Consider a teardown/cleanup block that always runs (e.g., a defer-style cleanup or a Testing teardown hook).

♻️ Example cleanup pattern (apply similarly to other server tests)

-        let user = try await app.createUser(email: email)
+        let user = try await app.createUser(email: email)
+        defer { Task { try? await user.delete() } }

         let channels = try await user.listContactChannels()
         `#expect`(!channels.isEmpty)
@@
-        // Clean up
-        try await user.delete()
+        // Clean up handled by defer

Also applies to: 113-127, 129-181

sdks/implementations/swift/Tests/StackAuthTests/TokenTests.swift (1)

189-217: Clarify the “same store” test intent.
This test uses explicit tokens rather than a shared store; consider renaming the description (or switching to a shared backend) to match behavior.

♻️ Suggested rename

-    `@Test`("Should share tokens between app instances with same store")
+    `@Test`("Should share tokens between app instances with explicit tokens")

sdks/implementations/swift/Examples/StackAuthMacOS/StackAuthMacOS/StackAuthMacOSApp.swift (1)

261-360: Consider main‑actor isolation for the view model.
Async tasks update observable UI state; main‑actor isolation avoids background‑thread mutations if any task hops off the main actor.

♻️ Suggested adjustment

-@Observable
-class SDKTestViewModel {
+@MainActor
+@Observable
+class SDKTestViewModel {

sdks/implementations/swift/Tests/StackAuthTests/UserManagementTests.swift (1)

24-25: Consider using guard-let or optional binding instead of force unwrapping.

Lines 25, 119, and 131 use force unwrapping (!) after nil checks. While functionally safe, this pattern is less idiomatic Swift and can mask issues if the code is refactored.

♻️ Suggested improvement using guard-let

-        `#expect`(id != nil)
-        `#expect`(!id!.isEmpty)
+        guard let id = id else {
+            Issue.record("id should not be nil")
+            return
+        }
+        `#expect`(!id.isEmpty)

sdks/implementations/swift/Sources/StackAuth/StackClientApp.swift (2)

588-588: Remove redundant optional initialization.

SwiftLint correctly identifies that initializing an optional to nil is redundant in Swift.

♻️ Fix redundant initialization

-        var restrictedReason: User.RestrictedReason? = nil
+        var restrictedReason: User.RestrictedReason?

---

626-641: Consider filtering null values from auth headers JSON.

The getAuthHeaders method includes nil values in the JSON object. Depending on how the backend interprets this, you may want to exclude null values to produce a cleaner header like {"accessToken":"..."} instead of {"accessToken":"...","refreshToken":null}.

♻️ Optional: Filter nil values

     public func getAuthHeaders() async -> [String: String] {
         let accessToken = await client.getAccessToken()
         let refreshToken = await client.getRefreshToken()
         
-        let json: [String: Any?] = [
-            "accessToken": accessToken,
-            "refreshToken": refreshToken
-        ]
+        var json: [String: Any] = [:]
+        if let accessToken = accessToken {
+            json["accessToken"] = accessToken
+        }
+        if let refreshToken = refreshToken {
+            json["refreshToken"] = refreshToken
+        }
         
         if let data = try? JSONSerialization.data(withJSONObject: json),
            let string = String(data: data, encoding: .utf8) {

sdks/implementations/swift/Sources/StackAuth/APIClient.swift (1)

173-186: Prevent re-entrant refresh races by setting isRefreshing before the first await.
The await on tokenStore.getRefreshToken() can yield, letting another caller enter and start a second refresh.

🛠️ Suggested fix

-        guard let refreshToken = await tokenStore.getRefreshToken() else {
-            return false
-        }
-        
-        isRefreshing = true
-        defer {
+        isRefreshing = true
+        defer {
             isRefreshing = false
             for waiter in refreshWaiters {
                 waiter.resume()
             }
             refreshWaiters.removeAll()
         }
+        
+        guard let refreshToken = await tokenStore.getRefreshToken() else {
+            return false
+        }

sdks/implementations/swift/Sources/StackAuth/Models/CurrentUser.swift (1)

7-79: selectedTeam stays stale after setSelectedTeam.

Line 7 declares selectedTeam as immutable, and Lines 73–79 don’t update local state after the server call. This reproduces the earlier state-divergence bug.

🐛 Suggested fix

-    public let selectedTeam: Team?
+    public private(set) var selectedTeam: Team?

     public func setSelectedTeam(_ team: Team?) async throws {
         try await update(selectedTeamId: team?.id)
+        self.selectedTeam = team
     }

     public func setSelectedTeam(id teamId: String?) async throws {
         try await update(selectedTeamId: teamId)
+        self.selectedTeam = userData.teams?.first { $0.id == teamId }
     }

sdks/implementations/swift/Sources/StackAuth/Models/Session.swift (1)

48-54: Use NSNumber.doubleValue for latitude/longitude parsing.
JSONSerialization yields NSNumber; as? Double can be brittle with integer-valued coords. Align with the created_at handling for consistency.

♻️ Suggested tweak

-        self.latitude = json["latitude"] as? Double
-        self.longitude = json["longitude"] as? Double
+        self.latitude = (json["latitude"] as? NSNumber)?.doubleValue
+        self.longitude = (json["longitude"] as? NSNumber)?.doubleValue

sdks/spec/src/_utilities.spec.md (1)

12-15: Duplicate: fix list indentation and bare URL.

This was already raised in a previous review for these lines. Please apply the earlier suggested fix.

sdks/implementations/swift/Sources/StackAuth/APIClient.swift (1)

212-214: Force unwrap on URL construction can crash.

This force unwrap was flagged in multiple past reviews but remains unaddressed. If baseUrl contains invalid characters, this will crash. Apply the same safe unwrapping pattern used in sendRequest at line 55-57.

🐛 Proposed fix

         // Build token refresh request
-        let url = URL(string: "\(baseUrl)/api/v1/auth/oauth/token")!
+        guard let url = URL(string: "\(baseUrl)/api/v1/auth/oauth/token") else {
+            await tokenStore.clearTokens()
+            return false
+        }
         var request = URLRequest(url: url)

sdks/implementations/swift/Sources/StackAuth/Models/CurrentUser.swift (3)

7-7: selectedTeam is immutable but setSelectedTeam() modifies server state.

selectedTeam is declared as let, so calling setSelectedTeam() updates the server but leaves the local property unchanged. This creates state divergence where currentUser.selectedTeam differs from the server's selected team.

🐛 Proposed fix

-    public let selectedTeam: Team?
+    public private(set) var selectedTeam: Team?

Then update setSelectedTeam methods to also update the local property after the server update succeeds.

---

73-79: setSelectedTeam methods don't update local selectedTeam property.

These methods call update(selectedTeamId:) but never refresh the local selectedTeam. The update() method only updates userData, not selectedTeam.

🐛 Proposed fix for both methods

     public func setSelectedTeam(_ team: Team?) async throws {
         try await update(selectedTeamId: team?.id)
+        self.selectedTeam = team  // Requires changing selectedTeam to var
     }
     
     public func setSelectedTeam(id teamId: String?) async throws {
         try await update(selectedTeamId: teamId)
+        // If selectedTeam is var, resolve from teams list:
+        // self.selectedTeam = teamId.flatMap { id in try? await listTeams().first { $0.id == id } }
     }

---

240-248: signOut() declares throws but suppresses errors with try?.

The function signature declares async throws but uses try? to silently ignore all errors. This misleads callers about error handling expectations. Either propagate errors with try or remove throws from the signature.

🐛 Proposed fix: remove throws if errors should be suppressed

-    public func signOut() async throws {
+    public func signOut() async {
         // Ignore errors - session may already be invalid
         _ = try? await client.sendRequest(

sdks/implementations/swift/Sources/StackAuth/StackClientApp.swift (5)

189-189: Force unwrap on URLComponents construction can crash.

This was flagged in past reviews. If baseUrl contains invalid characters, the force unwrap will crash. Use safe unwrapping with guard.

🐛 Proposed fix

-        var components = URLComponents(string: "\(baseUrl)/api/v1/auth/oauth/authorize/\(provider.lowercased())")!
+        guard var components = URLComponents(string: "\(baseUrl)/api/v1/auth/oauth/authorize/\(provider.lowercased())") else {
+            throw StackAuthError(code: "invalid_url", message: "Failed to construct OAuth authorization URL from base: \(baseUrl)")
+        }
         let publishableKey = await client.publishableClientKey

---

228-266: OAuth session may not be retained, causing potential hang.

The ASWebAuthenticationSession is created inside withCheckedThrowingContinuation but is a local variable. After session.start() is called and the closure scope exits, ARC may deallocate the session before the callback fires. Apple's documentation requires callers to retain the session until completion. Additionally, if start() returns false, the continuation is never resumed.

🐛 Proposed fix: retain session and check start() result

+    // Add property to retain the session
+    private var activeAuthSession: ASWebAuthenticationSession?
+    
     `@MainActor`
     public func signInWithOAuth(
         provider: String,
         presentationContextProvider: ASWebAuthenticationPresentationContextProviding? = nil
     ) async throws {
         let oauth = try await getOAuthUrl(provider: provider)
         
         let callbackScheme = "stackauth-\(projectId)"
         
         try await withCheckedThrowingContinuation { (continuation: CheckedContinuation<Void, Error>) in
             let session = ASWebAuthenticationSession(
                 url: oauth.url,
                 callbackURLScheme: callbackScheme
             ) { [weak self] callbackUrl, error in
+                self?.activeAuthSession = nil  // Release after callback
                 // ... existing completion handler
             }
             
+            self.activeAuthSession = session  // Retain session
             session.prefersEphemeralWebBrowserSession = false
             
             `#if` os(iOS) || os(macOS)
             if let provider = presentationContextProvider {
                 session.presentationContextProvider = provider
             }
             `#endif`
             
-            session.start()
+            if !session.start() {
+                self.activeAuthSession = nil
+                continuation.resume(throwing: StackAuthError(code: "oauth_session_failed", message: "Failed to start OAuth session"))
+            }
         }
     }

---

283-283: Force unwrap on URL construction can crash.

This force unwrap in callOAuthCallback was flagged in past reviews but remains. Apply safe unwrapping consistent with the rest of the codebase.

🐛 Proposed fix

         // Exchange code for tokens
-        let tokenUrl = URL(string: "\(baseUrl)/api/v1/auth/oauth/token")!
+        guard let tokenUrl = URL(string: "\(baseUrl)/api/v1/auth/oauth/token") else {
+            throw OAuthError(code: "invalid_url", message: "Failed to construct token exchange URL from base: \(baseUrl)")
+        }
         var request = URLRequest(url: tokenUrl)

---

559-575: getUser(or: .throw) silently returns nil instead of throwing.

When or == .throw is specified, errors and user filtering (anonymous/restricted checks) call handleNoUser() which always returns nil instead of throwing UserNotSignedInError(). The .throw case should actually throw an error, not return nil.

🐛 Proposed fix

-    private func handleNoUser(or: GetUserOr) -> CurrentUser? {
+    private func handleNoUser(or: GetUserOr) throws -> CurrentUser? {
         switch or {
         case .returnNull, .anonymous:
             return nil
         case .redirect:
             // Can't redirect in Swift
             return nil
         case .throw:
-            // Already thrown
-            return nil
+            throw UserNotSignedInError()
         }
     }

Then update call sites to use try handleNoUser(or: or).

---

651-658: signOut() declares throws but suppresses errors with try?.

Same issue as in CurrentUser.signOut(). The function signature promises it may throw, but try? silently suppresses all errors. Either propagate errors or remove throws.

🐛 Proposed fix

-    public func signOut() async throws {
+    public func signOut() async {
         _ = try? await client.sendRequest(

sdks/implementations/swift/Sources/StackAuth/APIClient.swift (1)

93-96: Consider using non-optional Data initializer.

Per static analysis, prefer Data(string.utf8) over "{}".data(using: .utf8) for guaranteed non-nil conversion.

♻️ Suggested refactor

         } else if method == "POST" || method == "PATCH" || method == "PUT" {
             // POST/PATCH/PUT requests need a body even if empty
             request.setValue("application/json", forHTTPHeaderField: "Content-Type")
-            request.httpBody = "{}".data(using: .utf8)
+            request.httpBody = Data("{}".utf8)
         }

sdks/implementations/swift/Sources/StackAuth/StackClientApp.swift (1)

632-632: Remove redundant nil initialization.

Per static analysis, initializing an optional variable with nil is redundant in Swift.

♻️ Suggested refactor

-        var restrictedReason: User.RestrictedReason? = nil
+        var restrictedReason: User.RestrictedReason?