I’m slightly confused about how are CloudKit containers supposed to handle app transfers. I’m seeing some strange too-permissive security behavior, and I am not sure whether this is a feature or a bug 🙂
Here’s the setup:
I had an app with bundleID com.example.something, talking to a CloudKit container also called com.example.something, all under the same developer account A. All was well.
I then transferred the app from developer account A to developer account B. The bundle ID or anything else about the app did not change, just the ownership. Must now also sign new builds of the app with credentials for account B, as expected. HOWEVER: the CK container also did not change at all, and remained under development account A.
What I am seeing now: the app signed by developer account B can still access the CK container under developer account A. No bundle IDs or CK ID-s changed, so I can sort of understand this, but at the same time, it seems strange.
There is no security risk to my data, as this app only uses "read" operation of the public database. I didn’t try any other operations or private databases.
Is this a bug and could it stop working? Or is this a feature which will remain working? This tells me that under certain conditions, any app can read the CK container of any other app from any developer account, if they know the correct CK container ID to talk to. Is this expected? (Or maybe it only keeps working because they were previously under the same developer account, and the system knows to keep this connection? And if I were try to randomly read any other app’s container, it would fail?) Any docs or guidance from Apple?
Ok. That makes sense. See my response below...copied here:
The app can access the CloudKit container (of A) because the App ID and the app's entitlements file contains the CloudKit container (of A). That was done when Developer A created the CloudKit container or used an existing CloudKit container to which they had access. That CloudKit container is still Developer A's. It did not transfer when the app ownership transfered.
Developer A can access that CloudKit container from their dashboard. That may be a security issue.
Developer B cannot access that CloudKit container from their dashboard. That might be an access issue. You can add Developer B to the team (of Developer A) that has access to the container in the dashboard.
And you now wish to move everything to Developer B and terminate Developer A. But the app is pointing to a container of Developer A so I don't think you can terminate Developer A. If you did, you would not be able to monitor CloudKit Dashboard even if Developer B became a member of Developer A's team. And it is unclear if the container would remain 'alive' - i.e. if it exceeded 'free' usage. You might be able to revise the app to point to a different container owned by B. That would require transitioning the data which could be complicated.
