RouterOS/RouterOSAssistant/Core/Services/KeychainService.swift

import Foundation
import Security

/// Stores router login passwords in the macOS Keychain, never in plaintext.
///
/// Account keys are `"username@host"`, optionally suffixed `"#<serialNumber>"` when the caller
/// knows which physical device it is. Without the serial, two different routers left at
/// MikroTik's factory default (192.168.88.1/admin) share one Keychain entry — confirmed live,
/// 2026-09-16: switching between two "Bekannte Router" entries for such devices (already
/// correctly kept separate by `SavedRoutersStore` since M26) kept loading the *same* remembered
/// password for both, since this store never looked past host+username. `loadPassword` still
/// falls back to the plain, unqualified key when no serial-qualified entry exists yet, so
/// passwords saved before this change (or for a device with no routerboard/serial at all) keep
/// working.
struct KeychainService {
    private let service = "com.focus72.RouterOSAssistant"

    private func account(host: String, username: String, serialNumber: String?) -> String {
        guard let serialNumber else { return "\(username)@\(host)" }
        return "\(username)@\(host)#\(serialNumber)"
    }

    func save(password: String, forHost host: String, username: String, serialNumber: String? = nil) {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: account(host: host, username: username, serialNumber: serialNumber)
        ]
        SecItemDelete(query as CFDictionary)

        var attributes = query
        attributes[kSecValueData as String] = Data(password.utf8)
        SecItemAdd(attributes as CFDictionary, nil)
    }

    func loadPassword(forHost host: String, username: String, serialNumber: String? = nil) -> String? {
        if let serialNumber,
           let password = loadPassword(account: account(host: host, username: username, serialNumber: serialNumber)) {
            return password
        }
        return loadPassword(account: account(host: host, username: username, serialNumber: nil))
    }

    private func loadPassword(account: String) -> String? {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: account,
            kSecReturnData as String: true,
            kSecMatchLimit as String: kSecMatchLimitOne
        ]
        var result: AnyObject?
        let status = SecItemCopyMatching(query as CFDictionary, &result)
        guard status == errSecSuccess, let data = result as? Data else { return nil }
        return String(data: data, encoding: .utf8)
    }

    func deletePassword(forHost host: String, username: String, serialNumber: String? = nil) {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: account(host: host, username: username, serialNumber: serialNumber)
        ]
        SecItemDelete(query as CFDictionary)
    }
}