Allow one app group on free teams by cesardev31 · Pull Request #284 · xtool-org/xtool

cesardev31 · 2026-09-28T20:33:03Z

What does this PR do?

Resolves the FIXME in DeveloperServicesCapability: App Groups are no longer filtered out on free teams, and DeveloperServicesAddAppOperation assigns at most one group per app on a free team (the constraint the FIXME mentioned).

Free teams can register and assign app groups through the Xcode DeveloperServices API (as AltStore/SideStore do), so a widget and its app can share UserDefaults(suiteName:) with a free Apple ID.

How was it tested?

Built on Linux from main (4d0c429). Installed a Flutter app with a WidgetKit extension on an iPhone (iOS 27.2) with a free Apple ID: the app gets group.XTL-<team>.<id> in its entitlements and the widget reads the app's data through it. make lint not run (no SwiftLint on this machine).

AI tool usage

How much of this PR was AI-assisted? (check one)

0 - No AI was used to write code
1 - I was assisted by AI. I reviewed the finished result.
2 - I set the AI going and left it to it; nobody has read the result - no review, or AI review only

Summary by CodeRabbit

Bug Fixes
- App Groups are now available to free teams.
- Apps assigned to more than one App Group are rejected with a clear error message.

Resolves the FIXME in DeveloperServicesCapability: free teams can register and assign app groups through the Xcode DeveloperServices API, so App Groups are no longer filtered out for them, and DeveloperServicesAddAppOperation assigns at most one group per app on a free team.

coderabbitai · 2026-09-28T20:33:19Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: e56c58f2-0315-4935-9a2f-640e9e53b36c

📥 Commits

Reviewing files that changed from the base of the PR and between 887e958 and f340cd2.

📒 Files selected for processing: 2

Sources/XKit/DeveloperServices/App IDs/DeveloperServicesAddAppOperation.swift
Sources/XKit/DeveloperServices/App IDs/Entitlements/DeveloperServicesCapability.swift

💤 Files with no reviewable changes: 1

Sources/XKit/DeveloperServices/App IDs/Entitlements/DeveloperServicesCapability.swift

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

App Groups are now marked as available to free teams. When a free-team entitlement contains multiple app groups, app creation throws a localized error with the bundle identifier and group count.

Changes: Free Team App Groups

Layer / File(s)	Summary
Free-team capability and assignment `Sources/XKit/DeveloperServices/App IDs/Entitlements/DeveloperServicesCapability.swift`, `Sources/XKit/DeveloperServices/App IDs/DeveloperServicesAddAppOperation.swift`	The capability declaration marks App Groups as free. Free-team app creation now rejects entitlements containing multiple app groups with a localized `tooManyAppGroups` error.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Suggested reviewers: kabiroberai

Merge Risk: ⚪ Minimal · up to f340c

The changed free-team App Group behavior is consistent across capability filtering and assignment.

Security architecture risk: 🟡 Moderate · up to 887e9

Free teams gain an intended shared-data capability. The one-group limit is applied to each provisioning request, but it is unclear whether it remains effective when an existing app is provisioned again with a different group.

Retained concerns

Medium · security · inferred: The one-group limit constrains each free-team request, not demonstrably the app’s persisted group associations. Re-provisioning with a different group could leave an earlier association in place if the remote service does not replace or reject it.

Security review details

Security Blast Radius

inferred — The changed eligibility affects apps and extensions provisioned under a free team that request App Groups. The intended outcome is sharing data through a group entitlement; evidence does not establish cross-team reachability.

Security Findings and Attack Paths

inferred — An executable can request a different first group on a later provisioning run. The client submits that group but does not remove earlier app assignments; whether this results in excess effective access depends on remote assignment and profile-generation behavior, which is not established.

Trust Boundaries and Controls

observed — The assignment operation requires Xcode authentication, lists groups for the authenticated team, and uses that team ID in group creation and assignment requests. It still relies on the remote service to validate supplied app and group identifiers.

Resilience and Maintainability Implications

inferred — Limiting the submitted list to one makes ordinary AddApp requests narrower, but without known remote uniqueness or replacement semantics, retries and changed requests do not demonstrate an at-most-one persisted-assignment invariant.

Hardening Proposals

proposed — Establish the service’s assignment and profile semantics, then enforce or reconcile the one-group rule at the boundary that owns persisted app-group associations; account for retries and direct consumers of the existing public assignment operation.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: allowing one App Group on free teams.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

The patch is now the diff of xtool-org/xtool#284: besides allowing App Groups on free teams, it assigns at most one group per app, as the FIXME it resolves asked. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LbkuTKpirPsGTLYJjm6UAB

kabiroberai

Thanks, small suggestions

kabiroberai · 2026-10-04T21:38:26Z

-        // but we need to always assign only one group
-        DeveloperServicesCapability(.appGroups, isFree: false)
+        // Free teams can use App Groups too; DeveloperServicesAddAppOperation
+        // assigns them at most one.


nit: this comment is unnecessary

kabiroberai · 2026-10-04T21:39:11Z

            let groupsEntitlement = entitlementsArray[groupsIdx] as? AppGroupEntitlement {
-            let groups = groupsEntitlement.rawValue
+            // Free teams get at most one app group per app.
+            let groups = isFreeTeam ? Array(groupsEntitlement.rawValue.prefix(1)) : groupsEntitlement.rawValue


would prefer throwing if there's more than one group. using prefix(1) means the other groups will just silently fail to be created.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kabiroberai requested changes Oct 4, 2026

View reviewed changes

Victor2411-hub mentioned this pull request Oct 10, 2026

Widget app extension: .appex binary is empty (dead-stripped) and the extension crashes in ExtensionFoundation on launch #313

Open

TartanLeGrand mentioned this pull request Oct 12, 2026

signer: reconcile entitlements with the provisioning profile #324

Open

4 of 6 tasks

Throw on multiple app groups for free teams

f340cd2

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cesardev31 requested a review from kabiroberai October 21, 2026 15:00

Navigation Menu

Repository navigation

Allow one app group on free teams - #284

Allow one app group on free teams#284
cesardev31 wants to merge 2 commits into
xtool-org:mainfrom
cesardev31:free-team-app-groups

cesardev31 commented Sep 28, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Sep 28, 2026 •

edited

Loading

Uh oh!

kabiroberai left a comment

Uh oh!

kabiroberai Oct 4, 2026

Uh oh!

kabiroberai Oct 4, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

cesardev31 commented Sep 28, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

How was it tested?

AI tool usage

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kabiroberai left a comment

Choose a reason for hiding this comment

Uh oh!

kabiroberai Oct 4, 2026

Choose a reason for hiding this comment

Uh oh!

kabiroberai Oct 4, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cesardev31 commented Sep 28, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Sep 28, 2026 •

edited

Loading