Feature request: Add Apple's Privacy Manifest

[Oleg-Pecheneg]

Is your feature request related to a problem?

There's a new requirement for the apps and SDKs from Apple to include description of some APIs usage.
Starting from May 1st, 2024 Apple will reject apps that don't comply with this regulation.
I can see that XMTP iOS SDK uses UserDefaults hence it should add Privacy manifest.

Describe the solution to the problem

Add Privacy manifest to the SDK specifying NSPrivacyAccessedAPICategoryUserDefaults reasons

Describe the uses cases for the feature

No response

Additional details

No response

[nplasterer]

Capturing osme context here: The User Defaults was recently added to store an encryption key for the group chat database. Ideally the integrator would do the storing and handling of the encryption key in the Secure Enclave not user defaults. Which is why we allow the encryption key to be passed in… wondering if it would be simpler for integrators for us to remove this dependency and instead error if no encryption key is provided. 🤔 @richardhuaaa & @zombieobject do you have any thoughts?

[richardhuaaa]

The UserDefaults doesn't add much security over encrypting with a hardcoded key given it's readily available to anyone with access to the device, so removing it makes sense.

Whether the encryption key argument being set by the integrator should be required or not seems like a matter of taste. If it is required, it forces integrators to think about it, and explicitly hardcode an encryption key value if they do not wish to use the keychain (unclear if helpful or not). If it is not required, it makes it easier to release debug builds with an unencrypted DB. I suppose I err towards giving the choice to developers, but I don't feel strongly!

[nplasterer]

Okay in favor of just dropping the UserDefaults encryption key for now. I'm going to add a error for now so that integrators using groups will not make the mistake of accidentally not providing a key for production data.

[zombieobject]

The UserDefaults doesn't add much security over encrypting with a hardcoded key given it's readily available to anyone with access to the device, so removing it makes sense.

I agree with both @nplasterer and @richardhuaaa here. UserDefaults should be discouraged entirely for this sort of thing and erroring is appropriate approach. 👨🏼‍🚒