ios: iCloud backup docs: launch keeps the last applied attribute

apps/ios/spec/database.md

@@ -80,7 +80,7 @@ The container choice is stored in `dbContainerGroupDefault` (`GroupDefaults`).
 
 The app group container is included in backup when the "Enable iCloud backup" toggle in "Database passphrase & export" is on (`DEFAULT_ICLOUD_BACKUP`, off by default) and [`iCloudBackupBlock`](../Shared/Views/Database/DatabaseView.swift) returns `nil`: the database is in the app group container, encrypted, and its passphrase was set by the user, not the initial random one. When `iCloudBackupBlock` returns a reason, the toggle is disabled and shown off (it shows the container's actual state, so in the share-extension gap below it can still show on), and its footer states the reason. The toggle is also disabled while an operation on that screen is in progress (`progressIndicator`, e.g. while a database is imported or deleted), and while the database needs to be reopened after import, deletion or a passphrase change (`ChatModel.chatDbChanged`), until the chat is started, with the footer saying so first, as the database state may be out of date. The toggle shows the actual attribute of the container ([`appDataIncludedInBackup()`](../SimpleXChat/FileUtils.swift)). The keychain passphrase is stored with `kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly`, so on another device the user has to enter it after a restore.
 
-[`updateAppDataBackup()`](../Shared/Views/Database/DatabaseView.swift) applies the rule in [`initializeChat`](../Shared/Model/SimpleXAPI.swift) after the database is opened and the file paths are set (the core re-creates `temp_files` then) — but not when `chatMigrateInit` returns its cached result without opening the database (e.g. unlocking the app after an import with the chat stopped), as the state would be of the previous database, after a successful passphrase change in [`DatabaseEncryptionView`](../Shared/Views/Database/DatabaseEncryptionView.swift), and when the toggle changes. [`prepareForLaunch()`](../Shared/AppDelegate.swift#L124-L127) calls `updateAppDataBackupOnLaunch()` before the database is opened. It never includes the app data, as encryption is only known once the database is opened: it excludes it when the toggle is off, the database is in Documents or uses the initial random passphrase, or the passphrase is stored in the keychain but no key is stored (the database is unencrypted, or its passphrase is not available yet — e.g. after importing an archive, which removes the key, or after a restore to another device); otherwise the container keeps the attribute applied when the database was last opened. It always excludes Documents, `temp_files` and `.bak` copies ([`excludeNonAppDataFromBackup()`](../SimpleXChat/FileUtils.swift)). While protected data is unavailable (the device is locked) it does nothing, and the attributes applied before stay.
+[`updateAppDataBackup()`](../Shared/Views/Database/DatabaseView.swift) applies the rule in [`initializeChat`](../Shared/Model/SimpleXAPI.swift) after the database is opened and the file paths are set (the core re-creates `temp_files` then) — but not when `chatMigrateInit` returns its cached result without opening the database (e.g. unlocking the app after an import with the chat stopped), as the state would be of the previous database, after a successful passphrase change in [`DatabaseEncryptionView`](../Shared/Views/Database/DatabaseEncryptionView.swift), and when the toggle changes. [`prepareForLaunch()`](../Shared/AppDelegate.swift#L124-L127) calls `updateAppDataBackupOnLaunch()` before the database is opened. It never includes the app data, as encryption is only known once the database is opened: it excludes it when the toggle is off, the database is in Documents or uses the initial random passphrase, or the passphrase is stored in the keychain but no key is stored (the database is unencrypted, or its passphrase is not available yet — e.g. after importing an archive, which removes the key, or after a restore to another device); otherwise the container keeps the attribute last applied to it. It always excludes Documents, `temp_files` and `.bak` copies ([`excludeNonAppDataFromBackup()`](../SimpleXChat/FileUtils.swift)). While protected data is unavailable (the device is locked) it does nothing, and the attributes applied before stay.
 
 Importing a database (including migration to this device) excludes the app data before the old database is removed, until the new one is opened. Deleting a database (including self-destruct) and restoring the database backup in [`DatabaseErrorView`](../Shared/Views/Database/DatabaseErrorView.swift) leave the attribute as it is: nothing of the deleted database remains on the device, and the new one is excluded when the app opens it (random passphrase) or at launch; a database created by the share extension in between stays in the container until then; the restored copy is the database as it was before the failed passphrase change, and the rule is applied again when it is opened. Voice messages are recorded into `app_files` unencrypted and encrypted only when sent, so [`AudioRecorder.start`](../Shared/Model/AudioRecPlay.swift) excludes the recording from backup once `record(forDuration:)` has created it; when "Encrypt local files" is on, sending encrypts it into a new file, which follows the container, and deletes the recording; when it is off, the recording is the sent file and stays excluded.
 

plans/ios-icloud-backup.md

@@ -24,7 +24,7 @@ The app group container is included in backup when the toggle is on and `iCloudB
 
 `excludeAppDataFromBackup(_:)` always excludes the Documents directory (legacy database, exported archives, migration files), `temp_files` (decrypted copies of files) and the `.bak` copies of the database (made by the core on passphrase changes and migrations, possibly unencrypted or with an old passphrase). It clears the attribute on the database files, because restoring a backup in `DatabaseErrorView` copies them from the excluded `.bak` files with `FileManager.copyItem`, which keeps the attribute.
 
-The rule is applied when the database is opened (after the file paths are set, as the core re-creates `temp_files`), after a passphrase change, when the toggle changes, and at launch, before the database is opened. Launch never includes the app data, because encryption is only known after opening (a passphrase stored in the keychain is saved before it is verified, e.g. after restoring a backup): it excludes it when the toggle is off, the database is in Documents or uses the random passphrase, or the passphrase is stored in the keychain without a key (the database is unencrypted, or its passphrase is not available yet — e.g. after importing an archive, which removes the key, or after a restore to another device); otherwise it keeps the decision applied at the last open. This is skipped while protected data is unavailable (the device is locked). Importing a database excludes the app data before the old database is removed, until the new one is opened. Deleting a database needs no exclusion: nothing of it remains, and the new database is excluded when it is opened (random passphrase) or at launch (no key is stored). The toggle is disabled while an import or deletion is in progress (`progressIndicator`), and after it until the chat is started again, as it would be based on the old database. "Delete temp data" (Developer → Storage) re-applies the exclusion to the `temp_files` directory it re-creates.
+The rule is applied when the database is opened (after the file paths are set, as the core re-creates `temp_files`), after a passphrase change, when the toggle changes, and at launch, before the database is opened. Launch never includes the app data, because encryption is only known after opening (a passphrase stored in the keychain is saved before it is verified, e.g. after restoring a backup): it excludes it when the toggle is off, the database is in Documents or uses the random passphrase, or the passphrase is stored in the keychain without a key (the database is unencrypted, or its passphrase is not available yet — e.g. after importing an archive, which removes the key, or after a restore to another device); otherwise the container keeps the attribute last applied to it. This is skipped while protected data is unavailable (the device is locked). Importing a database excludes the app data before the old database is removed, until the new one is opened. Deleting a database needs no exclusion: nothing of it remains, and the new database is excluded when it is opened (random passphrase) or at launch (no key is stored). The toggle is disabled while an import or deletion is in progress (`progressIndicator`), and after it until the chat is started again, as it would be based on the old database. "Delete temp data" (Developer → Storage) re-applies the exclusion to the `temp_files` directory it re-creates.
 
 Voice messages are recorded into `app_files` unencrypted and encrypted only when sent, so `AudioRecorder.start` excludes the recording from backup once `record(forDuration:)` has created it. A voice draft recorded since this change is therefore not backed up; recordings made by earlier versions are not excluded. When "Encrypt local files" is on, sending encrypts the recording into a new file, which follows the container, and deletes the recording; when it is off, the recording itself is the sent file and stays excluded.