Enhance SecureStore access with keychain accessibility

[seer-by-sentry]

Summary of the problem

Fixes HCB-MOBILE-6. The issue was that: Background task failed to retrieve tokens from iOS Keychain because default accessibility setting WHEN_UNLOCKED prevents access when device is locked.

Describe your changes

• Added keychainAccessible: SecureStore.AFTER_FIRST_UNLOCK option to SecureStore getItemAsync and setItemAsync calls for all token-related keys (ACCESS_TOKEN_KEY, REFRESH_TOKEN_KEY, EXPIRES_AT_KEY, TOKEN_CREATED_AT_KEY, CODE_VERIFIER_KEY).
• This ensures that the stored tokens are accessible after the device is unlocked for the first time, improving security and user experience.

This fix was generated by Seer in Sentry, triggered by Mohamad Mortada. 👁️ Run ID: 2257604

Not quite right? Click here to continue debugging with Seer.

Checklist

• Descriptive PR title (Does the title explain the changes in a concise manner?)
• Tag related issues so they auto-close on merge
• Easily digestible commits (Are the commits small and easy to understand?) video
• CI passes (Do the GitHub checks pass?)
• Tested by submitter before requesting review (Does it work in development iOS/android? )

[Copilot]

Pull Request Overview

This PR adds keychain accessibility configuration to SecureStore operations for authentication tokens. The change ensures that stored authentication data (access tokens, refresh tokens, expiration times, and code verifiers) are accessible after the first device unlock, which is a standard iOS security practice for sensitive app data.

Key Changes

• Added keychainAccessible: SecureStore.AFTER_FIRST_UNLOCK option to all getItemAsync calls in the token loading logic
• Added keychainAccessible: SecureStore.AFTER_FIRST_UNLOCK option to all setItemAsync calls in the token storage logic

Comments suppressed due to low confidence (2)

src/auth/AuthProvider.tsx:117

• The deleteItemAsync calls in the setTokens function should include the keychainAccessible option to match the accessibility level used when the items were stored. Without this, deletion may fail if the keychain items were stored with a specific accessibility level. Add { keychainAccessible: SecureStore.AFTER_FIRST_UNLOCK } as the second parameter to each deleteItemAsync call.

        await SecureStore.deleteItemAsync(ACCESS_TOKEN_KEY);
        await SecureStore.deleteItemAsync(REFRESH_TOKEN_KEY);
        await SecureStore.deleteItemAsync(EXPIRES_AT_KEY);
        await SecureStore.deleteItemAsync(TOKEN_CREATED_AT_KEY);
        await SecureStore.deleteItemAsync(CODE_VERIFIER_KEY);

src/auth/AuthProvider.tsx:135

• The deleteItemAsync calls in the forceLogout function should include the keychainAccessible option to match the accessibility level used when the items were stored. Without this, deletion may fail if the keychain items were stored with a specific accessibility level. Add { keychainAccessible: SecureStore.AFTER_FIRST_UNLOCK } as the second parameter to each deleteItemAsync call.

      await SecureStore.deleteItemAsync(ACCESS_TOKEN_KEY);
      await SecureStore.deleteItemAsync(REFRESH_TOKEN_KEY);
      await SecureStore.deleteItemAsync(EXPIRES_AT_KEY);
      await SecureStore.deleteItemAsync(TOKEN_CREATED_AT_KEY);
      await SecureStore.deleteItemAsync(CODE_VERIFIER_KEY);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.