appplayer_secure

Releases

1. ▸▾0.1.31 Aug 2026

   SecureStorage.listKeys failed on macOS with errSecParam (-50) on every call, while read / write / delete / exists on the same vault worked. Reported f

   SecureStorage.listKeys failed on macOS with errSecParam (-50) on every call, while read / write / delete / exists on the same vault worked. Reported from live Studio QA, where secret.list had never once succeeded.

   Cause. Enumeration went through the plugin's readAll, which asks the keychain for kSecMatchLimitAll together with kSecReturnData. A file-based keychain rejects that combination; only the data-protection keychain accepts it. This backend runs on the file-based login keychain by choice — MacOsOptions(useDataProtectionKeyChain: false), so an ad-hoc signed dev build can use the keychain without a paid signing identity. The limitation is therefore permanent for this backend, not a transient plugin bug. Single-key operations never touch that query shape, which is why only listing broke.

   wipeNamespace used the same call and was broken the same way. Nothing had exercised it.

   Fix. The backend keeps its own index of the keys it has written. listKeys and wipeNamespace read the index; neither calls readAll any more. Listing also stops asking for far more than it needs — it used to pull every stored plaintext to return a list of names, which on macOS can raise a per-item ACL prompt even where the query succeeds.

   Added

   • FlutterSecureStorageBackend.keyIndexSeeded — whether the index was seeded from the store's own contents. False means enumeration was unavailable when the index was first needed, so entries written by an earlier version are not listed. A caller that must not act on a partial view (a migration, a reset that reports what it will delete) should check it rather than treat listKeys as exhaustive. It sits on the concrete backend, not on the SecureStorage port: adding a member to the port would break every existing implementation, and the property describes this platform binding.

   Upgrading

   On macOS, keys written before this version cannot be adopted into the index — reading their names is the very call that fails — so they will not appear in listKeys. Everything written from this version on is listed. wipeAll() also makes the index exhaustive again. On every other platform the index is seeded from the existing store on first use and nothing is lost.