Fix macOS Access Groups

[rivera-ernesto]

When using Access Groups on macOS kSecUseDataProtectionKeychain needs to be set to true:

https://developer.apple.com/documentation/security/ksecusedataprotectionkeychain

Set the value for this key to true in the query dictionary when accessing a macOS keychain item that behaves like an iOS keychain item. For example, use the data protection key when adding, searching for, or deleting an item to which the kSecAttrAccessible or kSecAttrAccessGroup attributes apply.

The data protection key affects operations only in macOS. Other platforms automatically behave as if the key is set to true, and ignore the key in the query dictionary. You can safely use the key on all platforms.

Tip
It’s highly recommended that you set the value of this key to true for all keychain operations. This key helps to improve the portability of your code across platforms. Use it unless you specifically need access to items previously stored in a legacy keychain in macOS.

This pull request is a first fix for issues #438, #491 and #535

[rivera-ernesto]

Automatically set UseDataProtectionKeychain to true when an access group was set. This is required for macOS and doesn't affect other platforms

[rivera-ernesto]

Same thing here

[rivera-ernesto]

This code is from a class function, so we can't check if options has access groups set or not...

[rivera-ernesto]

...so I added an optional accessGroupsCompatible that defaults to true (per Apple documentation Tip)

[rivera-ernesto]

There may be other places that also require setting UseDataProtectionKeychain to true

[rivera-ernesto]

unapproved

Could you elaborate? 🙃

[kishikawakatsumi]

@rivera-ernesto That comment was written by an unrelated person. Please ignore it.