From f091ee7d538577adefd74954845ee0dcfcf44964 Mon Sep 17 00:00:00 2001
From: blessdyb <blessdyb@gmail.com>
Date: Sun, 25 Oct 2026 18:13:50 -0700
Subject: [PATCH] Remove unused Store server entitlement

Co-Authored-By: Claude Code <noreply@anthropic.com>
---
 .../FlowlightExtension-AppStore.entitlements  |  2 --
 project.yml                                   |  2 +-
 scripts/check_app_store_product.sh            | 31 +++++++++++++++++++
 3 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/FlowlightExtension/FlowlightExtension-AppStore.entitlements b/FlowlightExtension/FlowlightExtension-AppStore.entitlements
index 937bc21..b48cbd6 100644
--- a/FlowlightExtension/FlowlightExtension-AppStore.entitlements
+++ b/FlowlightExtension/FlowlightExtension-AppStore.entitlements
@@ -14,7 +14,5 @@
 	</array>
 	<key>com.apple.security.network.client</key>
 	<true/>
-	<key>com.apple.security.network.server</key>
-	<true/>
 </dict>
 </plist>
diff --git a/project.yml b/project.yml
index 755e295..f963b78 100644
--- a/project.yml
+++ b/project.yml
@@ -16,7 +16,7 @@ settings:
     CODE_SIGN_STYLE: Automatic
     ENABLE_HARDENED_RUNTIME: YES
     MARKETING_VERSION: "0.15.5"
-    CURRENT_PROJECT_VERSION: "50"
+    CURRENT_PROJECT_VERSION: "52"
   configs:
     AppStore:
       DEVELOPMENT_TEAM: 38RJUJHKZS
diff --git a/scripts/check_app_store_product.sh b/scripts/check_app_store_product.sh
index 29643c4..bc7ece1 100755
--- a/scripts/check_app_store_product.sh
+++ b/scripts/check_app_store_product.sh
@@ -2,16 +2,47 @@
 set -euo pipefail
 
 app=${1:?usage: check_app_store_product.sh /path/to/Flowlight.app}
+repo=$(cd "$(dirname "$0")/.." && pwd)
 contents="$app/Contents"
 extension="$contents/PlugIns/com.flowlight.app.filter.appex"
 app_binary="$contents/MacOS/Flowlight"
 extension_info="$extension/Contents/Info.plist"
+app_entitlements="$repo/Flowlight/Flowlight-AppStore.entitlements"
+extension_entitlements="$repo/FlowlightExtension/FlowlightExtension-AppStore.entitlements"
 
 fail() {
   echo "App Store product check failed: $*" >&2
   exit 1
 }
 
+plist_true() {
+  [ "$(/usr/libexec/PlistBuddy -c "Print :$2" "$1" 2>/dev/null)" = true ]
+}
+
+# The Store build disables HTTPS inspection: it neither installs a root certificate nor starts the local proxy.
+# Nothing in this product listens for inbound connections, so a server entitlement on either executable is a
+# least-privilege regression and will also stop automated App Review before the submission can proceed.
+if /usr/libexec/PlistBuddy -c 'Print :com.apple.security.network.server' "$app_entitlements" >/dev/null 2>&1; then
+  fail "Store app declares network.server even though Store inspection is disabled"
+fi
+if /usr/libexec/PlistBuddy -c 'Print :com.apple.security.network.server' "$extension_entitlements" >/dev/null 2>&1; then
+  fail "Store extension declares network.server but has no inbound listener"
+fi
+plist_true "$app_entitlements" com.apple.security.network.client || fail "Store app is missing network.client"
+plist_true "$extension_entitlements" com.apple.security.network.client || fail "Store extension is missing network.client"
+
+ruby -ryaml -e '
+  project = YAML.safe_load(File.read(ARGV.fetch(0)), aliases: true)
+  expected = {
+    "FlowlightAppStore" => "Flowlight/Flowlight-AppStore.entitlements",
+    "FlowlightStoreExtension" => "FlowlightExtension/FlowlightExtension-AppStore.entitlements"
+  }
+  expected.each do |target, path|
+    actual = project.dig("targets", target, "settings", "base", "CODE_SIGN_ENTITLEMENTS")
+    abort "#{target} uses #{actual.inspect}, expected #{path}" unless actual == path
+  end
+' "$repo/project.yml" || fail "Store targets use the wrong entitlement files"
+
 [ -x "$app_binary" ] || fail "missing app executable"
 [ -d "$extension" ] || fail "missing embedded content-filter app extension"
 [ ! -d "$contents/Library/SystemExtensions" ] || fail "contains a direct-distribution system extension"