Don't show key icon for empty passwords

.swiftpm/xcode/xcshareddata/xcschemes/BrowserServicesKit-Package.xcscheme

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
    LastUpgradeVersion = "1540"
-   version = "1.7">
+   version = "1.8">
    <BuildAction
       parallelizeBuildables = "YES"
       buildImplicitDependencies = "YES"

.swiftpm/xcode/xcshareddata/xcschemes/SubscriptionTests.xcscheme

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
    LastUpgradeVersion = "1540"
-   version = "1.7">
+   version = "1.8">
    <BuildAction
       parallelizeBuildables = "YES"
       buildImplicitDependencies = "YES"

Sources/BrowserServicesKit/Autofill/AutofillUserScript+SecureVault.swift

@@ -31,7 +31,7 @@ public protocol AutofillSecureVaultDelegate: AnyObject {
     var tld: TLD? { get }
 
     func autofillUserScript(_: AutofillUserScript, didRequestAutoFillInitDataForDomain domain: String, completionHandler: @escaping (
-        [SecureVaultModels.WebsiteAccount],
+        [SecureVaultModels.WebsiteCredentials],
         [SecureVaultModels.Identity],
         [SecureVaultModels.CreditCard],
         SecureVaultModels.CredentialsProvider
@@ -434,8 +434,8 @@ extension AutofillUserScript {
     func getAvailableInputTypes(_ message: UserScriptMessage, _ replyHandler: @escaping MessageReplyHandler) {
         let domain = hostForMessage(message)
         let email = emailDelegate?.autofillUserScriptDidRequestSignedInStatus(self) ?? false
-        vaultDelegate?.autofillUserScript(self, didRequestAutoFillInitDataForDomain: domain) { accounts, identities, cards, credentialsProvider  in
-            let response = RequestAvailableInputTypesResponse(accounts: accounts,
+        vaultDelegate?.autofillUserScript(self, didRequestAutoFillInitDataForDomain: domain) { credentials, identities, cards, credentialsProvider  in
+            let response = RequestAvailableInputTypesResponse(credentials: credentials,
                                                               identities: identities,
                                                               cards: cards,
                                                               email: email,
@@ -515,28 +515,31 @@ extension AutofillUserScript {
 
     func pmGetAutoFillInitData(_ message: UserScriptMessage, _ replyHandler: @escaping MessageReplyHandler) {
         let domain = hostForMessage(message)
-        vaultDelegate?.autofillUserScript(self, didRequestAutoFillInitDataForDomain: domain) { accounts, identities, cards, credentialsProvider in
-            let credentials: [CredentialObject]
+        vaultDelegate?.autofillUserScript(self, didRequestAutoFillInitDataForDomain: domain) { credentials, identities, cards, credentialsProvider in
+            let credentialObjects: [CredentialObject]
             if credentialsProvider.locked {
-                credentials = [CredentialObject(id: "provider_locked", username: "", credentialsProvider: credentialsProvider.name.rawValue)]
+                credentialObjects = [CredentialObject(id: "provider_locked", username: "", credentialsProvider: credentialsProvider.name.rawValue)]
             } else {
                 guard let autofillWebsiteAccountMatcher = self.vaultDelegate?.autofillWebsiteAccountMatcher else {
-                    credentials = accounts.compactMap {
-                        guard let id = $0.id else { return nil }
-                        return CredentialObject(id: id, username: $0.username ?? "", credentialsProvider: credentialsProvider.name.rawValue)
+                    credentialObjects = credentials.compactMap {
+                        if let id = $0.account.id {
+                            return CredentialObject(id: id, username: $0.account.username ?? "", credentialsProvider: credentialsProvider.name.rawValue)
+                        } else {
+                            return nil
+                        }
                     }
                     return
                 }
 
-                let accountMatches = autofillWebsiteAccountMatcher.findMatches(accounts: accounts, for: domain)
-                credentials = self.buildCredentialObjects(accountMatches, credentialsProvider: credentialsProvider)
+                let accountMatches = autofillWebsiteAccountMatcher.findMatches(accounts: credentials.map(\.account), for: domain)
+                credentialObjects = self.buildCredentialObjects(accountMatches, credentialsProvider: credentialsProvider)
             }
 
             let identities: [IdentityObject] = identities.compactMap(IdentityObject.from(identity:))
             let cards: [CreditCardObject] = cards.compactMap(CreditCardObject.autofillInitializationValueFrom(card:))
 
             let success = RequestAutoFillInitDataResponse.AutofillInitSuccess(serializedInputContext: self.serializedInputContext,
-                                                                              credentials: credentials,
+                                                                              credentials: credentialObjects,
                                                                               creditCards: cards,
                                                                               identities: identities)
 
@@ -810,8 +813,8 @@ extension AutofillUserScript.RequestAvailableInputTypesResponse {
          cards: [SecureVaultModels.CreditCard],
          email: Bool,
          credentialsProvider: SecureVaultModels.CredentialsProvider) {
-        let username = credentialsProvider.locked || credentials.filter({ $0.account.username?.isEmpty == false }).count > 0
-        let password = credentialsProvider.locked || credentials.count > 0
+        let username = credentialsProvider.locked || credentials.hasAtLeastOneUsername
+        let password = credentialsProvider.locked || credentials.hasAtLeastOnePassword
         let credentials = AutofillUserScript.AvailableInputTypesSuccess.AvailableInputTypesCredentials(username: username, password: password)
         let success = AutofillUserScript.AvailableInputTypesSuccess(
             credentials: credentials,
@@ -825,6 +828,22 @@ extension AutofillUserScript.RequestAvailableInputTypesResponse {
 
 }
 
+private extension Array where Element == SecureVaultModels.WebsiteCredentials {
+    var hasAtLeastOneUsername: Bool {
+        let elementsWithUsername = filter {
+            $0.account.username?.isEmpty == false
+        }
+        return !elementsWithUsername.isEmpty
+    }
+
+    var hasAtLeastOnePassword: Bool {
+        let elementsWithPassword = filter {
+            $0.password?.isEmpty == false
+        }
+        return !elementsWithPassword.isEmpty
+    }
+}
+
 extension AutofillUserScript.AvailableInputTypesSuccess.AvailableInputTypesIdentities {
 
     init(identities: [SecureVaultModels.Identity]) {

Sources/BrowserServicesKit/SecureVault/AutofillDatabaseProvider.swift

@@ -29,6 +29,7 @@ public protocol AutofillDatabaseProvider: SecureStorageDatabaseProvider {
 
     @discardableResult
     func storeWebsiteCredentials(_ credentials: SecureVaultModels.WebsiteCredentials) throws -> Int64
+    func websiteCredentialsForDomain(_ domain: String) throws -> [SecureVaultModels.WebsiteCredentials]
     func websiteCredentialsForAccountId(_ accountId: Int64) throws -> SecureVaultModels.WebsiteCredentials?
     func websiteAccountsForDomain(_ domain: String) throws -> [SecureVaultModels.WebsiteAccount]
     func websiteAccountsForTopLevelDomain(_ eTLDplus1: String) throws -> [SecureVaultModels.WebsiteAccount]
@@ -386,6 +387,34 @@ public final class DefaultAutofillDatabaseProvider: GRDBSecureStorageDatabasePro
         return nil
     }
 
+    public func websiteCredentialsForDomain(_ domain: String) throws -> [SecureVaultModels.WebsiteCredentials] {
+        try db.read {
+            try websiteCredentialsForDomain(domain, in: $0)
+        }
+    }
+
+    func websiteCredentialsForDomain(_ domain: String, in database: Database) throws -> [SecureVaultModels.WebsiteCredentials] {
+        let accounts = try SecureVaultModels.WebsiteAccount
+            .filter(SecureVaultModels.WebsiteAccount.Columns.domain.like(domain))
+            .fetchAll(database)
+
+        let accountIDs = accounts.compactMap(\.id)
+
+        var result = [SecureVaultModels.WebsiteCredentials]()
+
+        for accountID in accountIDs {
+            guard let accountIDInt = Int64(accountID) else {
+                continue
+            }
+            guard let credentials = try websiteCredentialsForAccountId(accountIDInt, in: database) else {
+                continue
+            }
+            result.append(credentials)
+        }
+
+        return result
+    }
+
     public func websiteCredentialsForAccountId(_ accountId: Int64) throws -> SecureVaultModels.WebsiteCredentials? {
         try db.read {
             try websiteCredentialsForAccountId(accountId, in: $0)

Sources/BrowserServicesKit/SecureVault/AutofillSecureVault.swift

@@ -61,6 +61,7 @@ public protocol AutofillSecureVault: SecureVault {
     func hasAccountFor(username: String?, domain: String?) throws -> Bool
     func updateLastUsedFor(accountId: Int64) throws
 
+    func websiteCredentialsFor(domain: String) throws -> [SecureVaultModels.WebsiteCredentials]
     func websiteCredentialsFor(accountId: Int64) throws -> SecureVaultModels.WebsiteCredentials?
     @discardableResult
     func storeWebsiteCredentials(_ credentials: SecureVaultModels.WebsiteCredentials) throws -> Int64
@@ -309,6 +310,31 @@ public class DefaultAutofillSecureVault<T: AutofillDatabaseProvider>: AutofillSe
 
     // MARK: - Credentials
 
+    public func websiteCredentialsFor(domain: String) throws -> [SecureVaultModels.WebsiteCredentials] {
+        lock.lock()
+        defer {
+            lock.unlock()
+        }
+
+        do {
+            let credentials = try self.providers.database.websiteCredentialsForDomain(domain)
+            return try credentials.map(decryptCredentials(_:))
+        } catch {
+            let error = error as? SecureStorageError ?? SecureStorageError.databaseError(cause: error)
+            throw error
+        }
+    }
+
+    private func decryptCredentials(_ credentials: SecureVaultModels.WebsiteCredentials) throws -> SecureVaultModels.WebsiteCredentials {
+        if let password = credentials.password {
+            let decryptedPassword = try self.l2Decrypt(data: password)
+            return .init(account: credentials.account,
+                         password: decryptedPassword)
+        } else {
+            return credentials
+        }
+    }
+
     public func websiteCredentialsFor(accountId: Int64) throws -> SecureVaultModels.WebsiteCredentials? {
         lock.lock()
         defer {
@@ -318,14 +344,8 @@ public class DefaultAutofillSecureVault<T: AutofillDatabaseProvider>: AutofillSe
         do {
             var decryptedCredentials: SecureVaultModels.WebsiteCredentials?
             if let credentials = try self.providers.database.websiteCredentialsForAccountId(accountId) {
-                if let password = credentials.password {
-                    decryptedCredentials = .init(account: credentials.account,
-                                                 password: try self.l2Decrypt(data: password))
-                } else {
-                    decryptedCredentials = credentials
-                }
+                decryptedCredentials = try decryptCredentials(credentials)
             }
-
             return decryptedCredentials
         } catch {
             let error = error as? SecureStorageError ?? SecureStorageError.databaseError(cause: error)

Sources/BrowserServicesKit/SecureVault/SecureVaultManager.swift

@@ -144,7 +144,7 @@ extension SecureVaultManager: AutofillSecureVaultDelegate {
 
     public func autofillUserScript(_: AutofillUserScript,
                                    didRequestAutoFillInitDataForDomain domain: String,
-                                   completionHandler: @escaping ([SecureVaultModels.WebsiteAccount],
+                                   completionHandler: @escaping ([SecureVaultModels.WebsiteCredentials],
                                                                  [SecureVaultModels.Identity],
                                                                  [SecureVaultModels.CreditCard],
                                                                  SecureVaultModels.CredentialsProvider) -> Void) {
@@ -167,16 +167,13 @@ extension SecureVaultManager: AutofillSecureVaultDelegate {
             }
 
             if delegate.secureVaultManagerIsEnabledStatus(self, forType: .password) {
-                getAccounts(for: domain,
-                            from: vault,
-                            or: passwordManager,
-                            withPartialMatches: includePartialAccountMatches) { [weak self] accounts, error in
+                getCredentials(forDomain: domain, from: vault, or: passwordManager) { [weak self] credentials, error in
                     guard let self = self else { return }
                     if let error = error {
                         os_log(.error, "Error requesting autofill init data: %{public}@", error.localizedDescription)
                         completionHandler([], [], [], self.credentialsProvider)
                     } else {
-                        completionHandler(accounts, identities, cards, self.credentialsProvider)
+                        completionHandler(credentials, identities, cards, self.credentialsProvider)
                     }
                 }
             } else {
@@ -790,6 +787,23 @@ extension SecureVaultManager: AutofillSecureVaultDelegate {
         }
     }
 
+    private func getCredentials(forDomain domain: String,
+                                from vault: any AutofillSecureVault,
+                                or passwordManager: PasswordManager?,
+                                completion: @escaping ([SecureVaultModels.WebsiteCredentials], Error?) -> Void) {
+        if let passwordManager = passwordManager,
+           passwordManager.isEnabled {
+            passwordManager.websiteCredentialsFor(domain: domain, completion: completion)
+        } else {
+            do {
+                let credentials = try vault.websiteCredentialsFor(domain: domain)
+                completion(credentials, nil)
+            } catch {
+                completion([], error)
+            }
+        }
+    }
+
     private func existingCredentialsInPasswordManager(with autofillData: AutofillUserScript.DetectedAutofillData,
                                                       domain: String,
                                                       vault: any AutofillSecureVault) -> SecureVaultModels.WebsiteCredentials? {

Tests/BrowserServicesKitTests/Autofill/AutofillVaultUserScriptTests.swift

@@ -562,7 +562,6 @@ class AutofillVaultUserScriptTests: XCTestCase {
 }
 
 class MockSecureVaultDelegate: AutofillSecureVaultDelegate {
-
     enum CallbackType {
         case didRequestCreditCardsManagerForDomain
         case didRequestIdentitiesManagerForDomain
@@ -623,7 +622,8 @@ class MockSecureVaultDelegate: AutofillSecureVaultDelegate {
 
     func autofillUserScript(_: BrowserServicesKit.AutofillUserScript,
                             didRequestAutoFillInitDataForDomain domain: String,
-                            completionHandler: @escaping ([BrowserServicesKit.SecureVaultModels.WebsiteAccount], [BrowserServicesKit.SecureVaultModels.Identity], [BrowserServicesKit.SecureVaultModels.CreditCard], BrowserServicesKit.SecureVaultModels.CredentialsProvider) -> Void) {
+                            completionHandler: @escaping ([BrowserServicesKit.SecureVaultModels.WebsiteCredentials], [BrowserServicesKit.SecureVaultModels.Identity], [BrowserServicesKit.SecureVaultModels.CreditCard], BrowserServicesKit.SecureVaultModels.CredentialsProvider) -> Void) {
+
     }
 
     func autofillUserScript(_: AutofillUserScript,

Tests/BrowserServicesKitTests/SecureVault/MockAutofillDatabaseProvider.swift

@@ -35,6 +35,7 @@ internal class MockAutofillDatabaseProvider: AutofillDatabaseProvider {
     var _creditCards = [Int64: SecureVaultModels.CreditCard]()
     var _forDomain = [String]()
     var _credentialsDict = [Int64: SecureVaultModels.WebsiteCredentials]()
+    var _credentialsForDomainDict = [String: [SecureVaultModels.WebsiteCredentials]]()
     var _note: SecureVaultModels.Note?
 
     var db: DatabaseWriter
@@ -66,6 +67,10 @@ internal class MockAutofillDatabaseProvider: AutofillDatabaseProvider {
         return _credentialsDict[accountId]
     }
 
+    func websiteCredentialsForDomain(_ domain: String) throws -> [BrowserServicesKit.SecureVaultModels.WebsiteCredentials] {
+        return _credentialsForDomainDict[domain] ?? []
+    }
+
     func websiteAccountsForDomain(_ domain: String) throws -> [SecureVaultModels.WebsiteAccount] {
         self._forDomain.append(domain)
         return _accounts

Tests/BrowserServicesKitTests/SecureVault/SecureVaultManagerTests.swift

@@ -308,19 +308,18 @@ class SecureVaultManagerTests: XCTestCase {
         let domain = "domain.com:1234"
         let username = "dax"
         let account = SecureVaultModels.WebsiteAccount(id: "1", title: nil, username: username, domain: domain, created: Date(), lastUpdated: Date())
-        self.mockDatabaseProvider._accounts = [account]
-
-        let credentials = SecureVaultModels.WebsiteCredentials(account: account, password: "password".data(using: .utf8)!)
-        try self.testVault.storeWebsiteCredentials(credentials)
+        let storedCredentials = SecureVaultModels.WebsiteCredentials(account: account, password: "password".data(using: .utf8)!)
+        self.mockDatabaseProvider._credentialsForDomainDict[domain] = [storedCredentials]
 
         let expect = expectation(description: #function)
 
         // When
-        manager.autofillUserScript(mockAutofillUserScript, didRequestAutoFillInitDataForDomain: domain) { accounts, _, _, _ in
+        manager.autofillUserScript(mockAutofillUserScript, didRequestAutoFillInitDataForDomain: domain) { credentials, _, _, _ in
 
             // Then
-            XCTAssertTrue(accounts.count == 1)
-            XCTAssertEqual(accounts.first!, account)
+            XCTAssertEqual(credentials.count, 1)
+            XCTAssertEqual(credentials.first?.account.id, storedCredentials.account.id)
+            XCTAssertEqual(credentials.first?.password, storedCredentials.password)
             expect.fulfill()
         }
         waitForExpectations(timeout: 0.1)