Greetings my fellow engineers,
I use SwiftData in my iOS app. The schema is unversioned and consists of a single model. I've been modifying the model for almost two years now and relying on automatic database migrations. I had no problems for all that time, but now trying to add a property to the model or even remove a property from the model results in an error which seems like SwiftData is no longer capable of performing an automatic migration.
The log console has things like the following:
CoreData: error: NSUnderlyingError : Error Domain=NSCocoaErrorDomain Code=134190 "(null)" UserInfo={reason=Each property must have a unique renaming identifier}
CoreData: error: reason : Can't find or automatically infer mapping model for migration
CoreData: error: storeType: SQLite
CoreData: error: configuration: default
CoreData: annotation: options:
CoreData: annotation: NSMigratePersistentStoresAutomaticallyOption : 1
CoreData: annotation: NSInferMappingModelAutomaticallyOption : 1
CoreData: annotation: NSPersistentStoreRemoteChangeNotificationOptionKey : 1
CoreData: annotation: NSPersistentHistoryTrackingKey : 1
CoreData: error: <NSPersistentStoreCoordinator: 0x7547b5480>: Attempting recovery from error encountered during addPersistentStore: 0x753f8d800 Error Domain=NSCocoaErrorDomain Code=134140 "Persistent store migration failed, missing mapping model."
Have you ever encountered such an issue? What are my options?
General
RSS for tagDelve into the world of built-in app and system services available to developers. Discuss leveraging these services to enhance your app's functionality and user experience.
Selecting any option will automatically load the page
Post
Replies
Boosts
Views
Created
I'm encountering a strange behavior with one of my home's on Home app while I'm off network. When I launch the app it indicates that the hub is not responding and all of my devices are unavailable.
However, on the menu bar at the bottom if I switch to "Automation" and back to "Home" the pop-up goes away and my devices are accessible again (sometimes this take a few attempts). Siri is also able to consistently control my devices without an issue.
The same behavior occurs with Home app on other devices (e.g. Mac) and with other members that have access to the household. 3rd party HomeKit app like "Controller" does not have an issue.
This issue began with iOS 26 and I haven't had much luck resolving the issue. I already tried rebooting everything, including removing and re-adding an Apple TV (home hub). I have other homes shared with me in Home App with similar network/environment that are still working. The home I'm having issues has the most number of devices though (over 100+).
The universal links for my apps stopped working.
The server where the AASA files where hosted worked on IPV4 exclusively, a few days ago i changed the configuration to IPV6 only. I´ve created new IPV6 entries, renewed all certifactes and deleted all IPV4 entries for the domains.
All seemed fine, but at Saturday I realized that my universal links stopped working for new user.
What i´ve done to find the issue:
Example domain that was used for debugging: "https://developffw.burns.fun"
I´ve verified the AASA file is hosted properly by using different browsers and Postman to retrieve it. The file can be accessed and the certificates look fine.
Output of curl -v https://developffw.burns.fun/.well-known/apple-app-site-association
* Host developffw.burns.fun:443 was resolved.
* IPv6: 2a01:4f8:13b:340a::2
* IPv4: (none)
* Trying [2a01:4f8:13b:340a::2]:443...
* schannel: disabled automatic use of client certificate
* ALPN: curl offers http/1.1
* ALPN: server accepted http/1.1
* Established connection to developffw.burns.fun (2a01:4f8:13b:340a::2 port 443) from 2a00:79c0:65c:8b00:80ee:175b:3e2a:1e7d port 61014
* using HTTP/1.x
> GET /.well-known/apple-app-site-association HTTP/1.1
> Host: developffw.burns.fun
> User-Agent: curl/8.16.0
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 200 OK
< Server: nginx/1.22.1
< Date: Mon, 15 Dec 2025 11:34:22 GMT
< Content-Type: application/octet-stream
< Content-Length: 329
< Last-Modified: Sat, 21 Dec 2024 08:53:11 GMT
< Connection: keep-alive
< ETag: "676681f7-149"
< Accept-Ranges: bytes
<
{
"applinks": {
"details": [
{
"appIDs": [ "6LN7G8JEA5.burns.FFW-Manager-SwiftUI.Debug"],
"components": [
{
"/": "/onboard",
"?": { "id": "*"},
"?": { "name": "*"},
"?": { "token": "*" }
}
]
}
]
}
}
* Connection #0 to host developffw.burns.fun:443 left intact
I took a look at the headers from the Apple CDN network response. These indicate some sort of connection error.
The response code is 404
Response headers:
Apple-Failure-Details: {"cause":"dial tcp [2a01:4f8:13b:340a::2]:443: connect: network is unreachable"}
Apple-Failure-Reason: SWCERR00305 Network error
Apple-From: https://betaffw.burns.fun/.well-known/apple-app-site-association
Apple-Try-Direct: false
Via: https/1.1 defra2-vp-vst-003.ts.apple.com (acdn/268.16305), https/1.1 defra2-vp-vfe-004.ts.apple.com (acdn/268.16305), http/1.1 defra2-xdc-mx-028.ts.apple.com (acdn/3.16363), https/1.1 defra1-edge-fx-021.ts.apple.com (acdn/3.16363)
X-Cache: hit-stale, miss, hit-fresh, miss
CDNUUID: 4321f35e-b73b-4031-a054-7c63af69e126-712221049
Took a look at the log files of the server.
I can´t find any entry from the Apple servers neither in the default logs nor in the error log entries.
The curl attempts are logged with response code 200.
I´ve tried sudo swcutil dl -d https://developffw.burns.fun/onboard in the Terminal on my MAC.
Output:
The operation couldn´t be completed. (SWCErrorDomain error 8.)
This indicates to me threre is an issue for the Apple servers accessing my server. But I don´t know what could be the reason. There is no firewall configuration that could block the requests. And there has been no change at all besides the IPV4 / IPV6 protocol change.
This issue is the same for all the domain listed on this server.
I´v even created a new app for this purpose and created a new AASA entry and associated link. Same issue.
I´m pretty much lost here. Everything looks fine from my side. Google assetlinks.json seem to work fine.
I would really appreciate some help on how to solve this, i´m at my wits end.
From the document https://developer.apple.com/documentation/sensorkit/srfetchrequest we know that "SensorKit places a 24-hour holding period on newly recorded data before an app can access it. This gives the user an opportunity to delete any data they don’t want to share with the app. A fetch request doesn’t return any results if its time range overlaps this holding period."
Will this holding period reset each time when I called startRecording() ?
Let's say I upgrade my app to a new version, do I need to call startRecording again to init the data collection process? will it be able to query the data collected from previous version's app ?
Topic:
App & System Services
SubTopic:
General
My application is from a bank that provides payment passes, and when I try to retrieve passes already enrolled in the wallet, it always returns empty. Is there something I need to configure for it to work? This is what I've tried, and it hasn't worked
Topic:
App & System Services
SubTopic:
General
We are developing a hybrid iOS app where Angular content is rendered inside a WKWebView, hosted by a native Swift application.
We use the GameController framework to detect whether an external Bluetooth keyboard is connected to an iPad. The following code is executed when the app enters the foreground and also when requested by the web layer:
func keyboardStatusHandler(){
let isKeyboardConnected = GCKeyboard.coalesced != nil
if(!isKeyboardConnected){
//sent status to Angular
} else {
//sent status to Angular
}
}
Crash details
We are seeing intermittent crashes on iPad with the following stack trace:
Crashed: GCDeviceSession.HID
0 libobjc.A.dylib 0x7db8 objc_retain_x8 + 16
1 libsystem_blocks.dylib 0xfb8 void HelperBase<ExtendedInline>::copyCapture<(HelperBase<ExtendedInline>::BlockCaptureKind)3>(unsigned int) + 48
2 libsystem_blocks.dylib 0xbc4 HelperBase<GenericInline>::copyBlock(Block_layout*, Block_layout*) + 108
3 libsystem_blocks.dylib 0xc94 _call_copy_helpers_excp + 60
4 libsystem_blocks.dylib 0xef8 _Block_copy + 412
5 libdispatch.dylib 0x1a70 _dispatch_Block_copy + 32
6 libdispatch.dylib 0x792c dispatch_async + 56
7 libdispatch.dylib 0x792c dispatch_channel_async + 56
8 GameController 0xea6dc -[GCKeyboardInput _handleKeyboardEvent:] + 324
9 GameController 0x22508 __53-[_GCKeyboardEventHIDAdapter initWithSource:service:]_block_invoke + 376
10 GameController 0x11d30 -[_GCHIDEventSubject publishHIDEvent:] + 268
11 GameController 0xb79cc __40-[_GCHIDEventUIKitClient initWithQueue:]_block_invoke_3 + 44
12 libdispatch.dylib 0x1b584 _dispatch_client_callout + 16
13 libdispatch.dylib 0x12088 _dispatch_async_and_wait_invoke_and_complete_recurse + 272
14 libdispatch.dylib 0x8448 _dispatch_async_and_wait_f + 108
15 GameController 0xb7984 __40-[_GCHIDEventUIKitClient initWithQueue:]_block_invoke_2 + 132
16 GameController 0xb746c __48-[__GCHIDEventUIKitClient _initWithApplication:]_block_invoke + 256
17 UIKitCore 0x11fd394 __61-[UIEventFetcher _setHIDGameControllerEventObserver:onQueue:]_block_invoke_3 + 40
18 libdispatch.dylib 0x1aac _dispatch_call_block_and_release + 32
19 libdispatch.dylib 0x1b584 _dispatch_client_callout + 16
20 libdispatch.dylib 0xa2d0 _dispatch_lane_serial_drain + 740
21 libdispatch.dylib 0xadac _dispatch_lane_invoke + 388
22 libdispatch.dylib 0x151dc _dispatch_root_queue_drain_deferred_wlh + 292
23 libdispatch.dylib 0x14a60 _dispatch_workloop_worker_thread + 540
24 libsystem_pthread.dylib 0xa0c _pthread_wqthread + 292
25 libsystem_pthread.dylib 0xaac start_wqthread + 8
Observed scenarios
Crash occurs when the app transitions from background to foreground
Crash also occurs when the Angular layer requests keyboard status, triggering the same code path
Questions
Has anyone encountered crashes related to GCKeyboard.coalesced or GCKeyboardInput like this?
Are there known issues with the GameController framework when querying keyboard state during app lifecycle transitions?
Is there a recommended or safer way to detect external keyboard connection status on iPad (especially when using WKWebView)?
Any insights, known platform issues, or suggested workarounds would be greatly appreciated.
Thanks!
Has anyone seen this issue?
We have a user who changed their Apple ID password about 5 days ago. Now when they authenticate via MusicKit JS:
authorize() succeeds and returns a user token
Immediately calling any /me/ endpoint returns 403 "Invalid authentication" (code 40300)
Developer token works fine on catalog endpoints
User has active Apple Music subscription
Other users work fine through the same flow
App doesn't appear in user's "Apps Using Your Apple ID"
We've tried:
Calling unauthorize() before authorize()
Clearing localStorage/sessionStorage/cookies
Multiple re-auth attempts over several days
The token is freshly issued but Apple's API immediately rejects it.
Anyone encountered this after a password change? Any workarounds?
Hello,
After being in the AppStore for more than a year with the app working perfectly, yesterday I started seeing that WeatherKit requests failed with
Failed to generate jwt token for: com.apple.weatherkit.authservice with error: Error Domain=WeatherDaemon.WDSJWTAuthenticatorServiceListener.Errors Code=2 "(null)"
Encountered an error when fetching weather data subset; location=<+41.40217108,+2.20023642> +/- 0.00m (speed -1.00 mps / course -1.00) @ 13/12/25, 12:20:35 Central European Standard Time, error=WeatherDaemon.WDSJWTAuthenticatorServiceListener.Errors 2 Error Domain=WeatherDaemon.WDSJWTAuthenticatorServiceListener.Errors Code=2 "(null)"
I checked on developer.apple.com and we still have everything turned on and
No changes were made from an already deployed app; and we pay 200$ a month for WeatherKit, this is unacceptable since it's not the first time WeatherKit randomly decides to stop working.
More fun facts: the widget works fine...
For other permission prompts in the iOS ecosystem, we have the option to configure the text shown in the prompt via keys in the Info.plist. This does not appear to be the case with regards to the age range permission prompt. The text of the prompt implies the app includes a differentiated experience for child or teen content and that confirming age unlocks more features (making it seem optional for using the app).
Is there a plan for app developers to be able to update that permission prompt similarly to how we can configure others?
If so, is there any timeline we can expect that on?
My app updates are repeatedly rejected under Guideline 2.3.6 – Accurate Metadata, with a request to remove “Age Assurance” unless the feature can be located.
However, the app does include age assurance. During onboarding, users must enter their date of birth, and users under 16 are blocked from completing registration and using the app. The app contains a women’s health blog and a community Q&A feature (similar to Reddit), where users can ask and answer health-related questions. For this reason, I am considering restricting access to users 18 and older.
Each time I explain this to the review team and provide a screenshot of the DOB screen, the app is approved.
What is the correct way to document or surface this in App Store Connect so reviewers can easily find it and avoid repeated rejections? Is a DOB gate sufficient for Apple’s definition of Age Assurance?
Share Age Range Permission is set to 'Ask First'.
Application requested for AgeRange via requestAgeRange API.
System presented a consent window where user has to make a choice.
User did not acted.
Application was pushed to background.
Our Application supports PushToTalk Framework and we have successfully joined the channel already.
User tapped on the blue-pill , SystemUI will get presented.
User tapped on the SystemUI, A New Full Screen SystemUI will get presented.
User chosen 'Leave' option and our application left the active channel.
10 User brought the application to foreground and the previous "Share Age Range" system window disappeared.
11. After Step 10, We need to terminate and launch our application in order to get the "Share Age Range" system window.
Is "Share Age Range" system window getting disappear is expected here or a BUG
Hey all,
Running into an issue with a WeatherKit.
Whenever I make a WeatherKit API call, I get this error:
Details: { domain: WeatherDaemon.WDSClientErrors, localizedDescription: invalidAuthorization: 401, underlyingError: Unknown, code: 3 }
This only happens when calling via the Swift package:
swift
WeatherService.shared.weather(for: location).currentWeather
When I was calling the WeatherKit REST API directly from Dart, everything worked fine.
So far I’ve:
Enabled WeatherKit in the Apple Developer account
Added the WeatherKit capability to the app
Refreshed provisioning profiles
Installed the app fresh on device/simulator
Has anyone seen this specific invalidAuthorization: 401 from WeatherDaemon.WDSClientErrors when using WeatherService in Swift, and know what might be missing or misconfigured?
Hello,
I’m currently reviewing and implementing age assurance and parental approval flows using AgeRangeService and PermissionKit (AskCenter) in the context of Texas regulatory compliance requirements.
While the high-level APIs are clear, there are several technical aspects where the intended usage patterns are not fully explicit in the documentation. Clarification on these points would help ensure our implementation aligns with system expectations and regulatory obligations.
⸻
Querying the current approval state for SignificantAppUpdateTopic
AskCenter.ask(...) returns Void, and AskCenter.responses(for:) provides an AsyncSequence of approval events.
Is there an official or recommended way to determine whether a SignificantAppUpdateTopic has already been approved when the app launches, or is listening for future responses events the only supported mechanism?
⸻
Behavior of AskCenter.responses(for:) regarding past approvals
When subscribing to AskCenter.responses(for:):
• Does the stream replay previously recorded approval or decline decisions?
• Or does it only emit events that occur after subscription?
This affects whether the listener must be registered early in the app lifecycle.
⸻
Recommended lifecycle timing for registering a responses(for:) listener
What is the intended or recommended time to register a responses(for:) listener?
• At application launch
• Immediately before calling ask(...)
• When entering a specific gated feature
Clarification on the expected lifecycle usage would be helpful.
⸻
Repeated calls to ask(...) after approval
If AskCenter.ask(...) is called again for the same SignificantAppUpdateTopic after parental approval has already been granted:
• Is the request ignored?
• Is a new approval request sent to the parent?
• Or is the call handled idempotently by the system?
⸻
Delivery of approval results when the child app is not running
If a parent approves or declines a SignificantAppUpdateTopic while the child app is not running:
• Will the approval decision be delivered as a responses(for:) event on the next app launch?
• Or is the app expected to persist approval state locally?
⸻
Persistence of approval state
Is the approval decision for SignificantAppUpdateTopic persisted by the system at the OS level, or is the app responsible for storing approval state?
Additionally, does the approval persist across:
• app restarts?
• app deletion and reinstallation?
⸻
Meaning of activeParentalControls.significantAppChangeApprovalRequired
How is activeParentalControls.significantAppChangeApprovalRequired determined?
• Is this value explicitly configured by a parent (for example via Screen Time)?
• Or is it automatically determined by the system based on region, age, or regulatory requirements?
⸻
Relationship between significantAppChangeApprovalRequired and AgeRangeService
When activeParentalControls contains significantAppChangeApprovalRequired, is it still expected that apps call AgeRangeService.requestAgeRange(...)?
Or can the presence of this flag be treated as sufficient indication that the user is a minor for gating purposes?
⸻
Recommended interpretation of AgeRangeDeclaration
Is the intended usage of AgeRangeDeclaration to handle each case individually, or is it acceptable and recommended to interpret the values as different trust levels (for example, self-declared vs. government ID or payment verified)?
⸻
Clarification on these points would help ensure that implementations of age assurance and parental approval flows are consistent with system behavior while meeting regulatory compliance requirements.
Thank you for your guidance.
I recently submitted an Advanced App Clip Experience, and the status currently shows as "Received."
My default App Clip Experience is already working well, but I need the advanced experience to go live as soon as possible. Does anyone know the typical timeframe for this to be published?
Also, will the status change from "Received" to something else when it is fully active? Any insight would be appreciated.
Thanks!
Hello,
I’m currently reviewing and implementing age assurance and parental approval flows using AgeRangeService and PermissionKit (AskCenter) in the context of Texas regulatory compliance requirements.
While the high-level APIs are clear, there are several technical aspects where the intended usage patterns are not fully explicit in the documentation. Clarification on these points would help ensure our implementation aligns with system expectations and regulatory obligations.
⸻
Querying the current approval state for SignificantAppUpdateTopic
AskCenter.ask(...) returns Void, and AskCenter.responses(for:) provides an AsyncSequence of approval events.
Is there an official or recommended way to determine whether a SignificantAppUpdateTopic has already been approved when the app launches, or is listening for future responses events the only supported mechanism?
⸻
Behavior of AskCenter.responses(for:) regarding past approvals
When subscribing to AskCenter.responses(for:):
• Does the stream replay previously recorded approval or decline decisions?
• Or does it only emit events that occur after subscription?
This affects whether the listener must be registered early in the app lifecycle.
⸻
Recommended lifecycle timing for registering a responses(for:) listener
What is the intended or recommended time to register a responses(for:) listener?
• At application launch
• Immediately before calling ask(...)
• When entering a specific gated feature
Clarification on the expected lifecycle usage would be helpful.
⸻
Repeated calls to ask(...) after approval
If AskCenter.ask(...) is called again for the same SignificantAppUpdateTopic after parental approval has already been granted:
• Is the request ignored?
• Is a new approval request sent to the parent?
• Or is the call handled idempotently by the system?
⸻
Delivery of approval results when the child app is not running
If a parent approves or declines a SignificantAppUpdateTopic while the child app is not running:
• Will the approval decision be delivered as a responses(for:) event on the next app launch?
• Or is the app expected to persist approval state locally?
⸻
Persistence of approval state
Is the approval decision for SignificantAppUpdateTopic persisted by the system at the OS level, or is the app responsible for storing approval state?
Additionally, does the approval persist across:
• app restarts?
• app deletion and reinstallation?
⸻
Meaning of activeParentalControls.significantAppChangeApprovalRequired
How is activeParentalControls.significantAppChangeApprovalRequired determined?
• Is this value explicitly configured by a parent (for example via Screen Time)?
• Or is it automatically determined by the system based on region, age, or regulatory requirements?
⸻
Relationship between significantAppChangeApprovalRequired and AgeRangeService
When activeParentalControls contains significantAppChangeApprovalRequired, is it still expected that apps call AgeRangeService.requestAgeRange(...)?
Or can the presence of this flag be treated as sufficient indication that the user is a minor for gating purposes?
⸻
Recommended interpretation of AgeRangeDeclaration
Is the intended usage of AgeRangeDeclaration to handle each case individually, or is it acceptable and recommended to interpret the values as different trust levels (for example, self-declared vs. government ID or payment verified)?
Clarification on these points would help ensure that implementations of age assurance and parental approval flows are consistent with system behavior while meeting regulatory compliance requirements.
Thank you for your guidance.
When syncing an Office 365 (Exchange) account on an M1 Max machine running the latest macOS (e.g., Sonoma), the native contactsd and AddressBookManager processes enter a severe, persistent failure loop. The CPU usage spikes from 0.0% to over 80% (observed at 81%) and repeats every 60-90 seconds. This occurs even when the account is entirely empty of contacts and after performing a clean macOS installation, strongly indicating a systemic bug in the framework's Exchange protocol handler on the M1 architecture.
System Information
Affected Hardware: Apple M1 Max
Affected macOS Version: Tahoe 26.1
Affected Processes: contactsd, AddressBookManager
Account Type: Microsoft Exchange / Office 365
Steps to Reproduce
System Setup: Perform a clean installation of macOS on the M1 Max machine (USB boot, NO Migration Assistant or data restoration).
Account Preparation: Ensure the target Exchange account's contacts folder is entirely empty on the server (via Outlook Web Access).
Trigger: Go to System Settings > Internet Accounts and add the Exchange account. Ensure ONLY Contacts is toggled ON.
Observation: Open Activity Monitor and sort by % CPU.
Expected Behavior
The contactsd and AddressBookManager processes should spike briefly (under 5%) to establish the empty sync, then settle to a persistent idle state (0.0% to 0.5% CPU).
Actual Behavior
The processes never settle:
CPU Spikes: Usage repeatedly jumps from 0.0% to 81% for AddressBookManager and 22-59% for contactsd.
Pattern: This extreme spike lasts for a few seconds before the thread crashes/restarts, and the process immediately re-initiates the loop, consuming massive CPU cycles continuously.
Diagnostic Proof
The runaway CPU is not caused by corrupt data:
Data Neutralization: The account's contacts folder was emptied on the server, yet the high CPU loop persisted when syncing.
Clean System: The issue is reproducible on a clean, from-scratch macOS installation, ruling out corrupted user preferences or system files.
Cross-Architecture: The exact same account syncs perfectly on iOS and newer M4 Macs, confirming the data is valid and the issue is specific to the M1 Max's implementation of the Exchange protocol handler.
Workaround (For Visibility)
To restore system performance, the user must DELETE the entire Exchange account from System Settings > Internet Accounts and use a third-party client (e.g., Outlook for Mac) for synchronization, as it bypasses the buggy native framework.
Topic:
App & System Services
SubTopic:
General
I have a watch only app that display an open/close park status and the current temperature with a current condition icon. That's it. On second submission the watch app was rejected due to no WeatherKit attribution. I have a lack of clarity of what's needed. With my single view that display my content I don't want WeatherKit attribution to overwhelm what's being presented to the user. I've tried looking for watch apps in the store that provide attribution and I'm not finding any. Looking for advice on how to meet this requirement without attribution overpowering my content.
Our team is in the process of updating our apps to comply with Texas's new state law.
In order to minimize user confusion and provide the most ideal flow to access the app as possible, we have a few questions we would like answered.
Summary of questions:
Is isEligibleForAgeFeatures intended to be accurate and accessible before the user has accepted the Age Range permissions prompt?
As other US states and/or other countries adopt a similar law going forward, will this instance variable cover those locations?
Will the runtime crashes on isEligibleForAgeFeatures and other symbols in the DeclaredAgeRange framework be addressed in a future RC or in the official release?
Details and Investigations:
With regards to isEligibleForAgeFeatures, our team has noticed that this value is always false before the age range prompt has been accepted. This has been tested on the XCode RC 26.2 (17C48).
Assuming the request needs to be accepted first,
isEligibleForAgeFeatures does not get updated immediately when the user chooses to share their age range (updated to true, when our sandbox test account is a Texas resident). Only upon subsequent relaunches of the app does this return a value that reflects the sandbox user's location. Is isEligibleForAgeFeatures intended to be accurate and accessible before the user has accepted the Age Range permissions prompt?
This leads to our follow-up question to clarify whether isEligibleForAgeFeatures explicitly correlates to a user in an affected legal jurisdiction–if future US states and/or other countries adopt a similar law going forward, will this instance variable cover those locations?
Can we also get confirmation about whether the runtime crash on isEligibleForAgeFeatures and other symbols in the DeclaredAgeRange framework will be addressed in a future RC or in the official release?
Thank you.
Hi everyone,
I have a question regarding the intended privacy limits of the DeviceActivityReportExtension.
According to the documentation and the WWDC21 session "Meet the Screen Time API", this extension was created specifically to prevent the host application from accessing the user's underlying activity data (websites visited, app usage, screen time, etc).
But I have found that my host app is actually able to reconstruct this raw activity data from the activity report. I am able to extract specific visited websites and app usage durations back into the main app.
I reported this to Apple Security (Case ID: OE1100504480881 ), assuming it was a sandbox bypass. However, they closed the ticket stating that this is "expected behavior" and requires no fix.
My question for Screen Time Engineers: Is the documentation incorrect? If my host app is expected to be able to read this data, is there a formal API we should be using instead of extracting it from the report extension?
The current behavior contradicts the privacy limits described in the documentation, so I am confused if I should rely on this data access for my app features or if it will be patched later.
Thanks.
After reading the news below, we are currently working on updating our app in preparation for the enforcement of Texas SB 2420.
https://developer.apple.com/news/?id=2ezb6jhj
Based on the information in the announcement, we understand that parents will be able to revoke their consent for apps.
However, we are unsure how an app is supposed to obtain or verify the parent’s consent status in the first place.
We reviewed the Declared Age Range API and PermissionKit’s Significant Change API, but could not find any functionality related to this.
If anyone with expertise on this topic has insight, we would greatly appreciate your guidance.
Thank you in advance.