feat: add clearAll() API to CredentialsManager and deleteAllEntries() method CredentialsStorage by utkrishtsahu · Pull Request #1116 · auth0/Auth0.swift

utkrishtsahu · 2026-03-13T03:49:10Z

All new/changed/fixed functionality is covered by tests (or N/A)
I have added documentation for all new/changed functionality (or N/A)

📋 Changes

Added a new clearAll() throws API to CredentialsManager and a new deleteAllEntries() throws method to the CredentialsStorage protocol.

Types and methods added:

CredentialsStorage.deleteAllEntries() throws — New protocol requirement that deletes all storage entries. The SimpleKeychain extension implements this by calling SimpleKeychain.deleteAll().
CredentialsManager.clearAll() throws — New public method that removes all keychain entries managed by the Credentials Manager and resets the biometric authentication session. This differs from the existing clear() method, which only removes the default credentials entry.

Usage:

do {
    try credentialsManager.clearAll()
} catch {
    print("Failed to clear all credentials: \(error)")
}

Migration guide: Updated V3_MIGRATION_GUIDE.md with documentation for both new APIs, including migration examples for custom CredentialsStorage implementations.

📎 References

SDK-7983

🎯 Testing

Unit tests (3 new tests added to CredentialsManagerSpec):

Should clear all credentials from keychain — Stores credentials, calls clearAll(), verifies hasValid() returns false
Should not throw when keychain is already empty — Calls clearAll() on empty storage, verifies no error is thrown
Should throw when storage fails — Uses a mock storage that throws on deleteAllEntries(), verifies the error propagates
Manual testing (sample app on iPhone 17 Pro simulator):

Manual(Emulator)
Launched the app → checkAuthentication confirmed no credentials in keychain
Logged in via Web Auth → Verified credentials (access token, ID token, refresh token) were stored in keychain via CredentialsManager -> SimpleKeychain
Tapped "Clear All Credentials" → Verified SimpleKeychain.deleteAll() was called, all entries removed, biometric session reset, hasValid() = false
Tapped "Clear All Credentials" on empty keychain → Verified no error thrown, operation succeeds gracefully

… to CredentialsStore

…ialsManager

Copilot

Pull request overview

Adds a new “clear everything” capability to Auth0.swift’s Credentials Manager by extending the storage abstraction and documenting the change for v3 migration.

Changes:

Add CredentialsManager.clearAll() throws to wipe all stored credential entries and reset the biometric session.
Extend CredentialsStorage with deleteAllEntries() throws, including a SimpleKeychain implementation.
Add test coverage and v3 migration guide entries for the new APIs.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
V3_MIGRATION_GUIDE.md	Documents the new `clearAll` / `deleteAllEntries` APIs and migration impact.
Auth0Tests/CredentialsManagerSpec.swift	Adds specs verifying `clearAll()` behavior and updates mocks for the new protocol requirement.
Auth0/CredentialsStorage.swift	Extends the storage protocol and implements `deleteAllEntries()` for `SimpleKeychain`.
Auth0/CredentialsManager.swift	Introduces `clearAll()` that resets biometric session and delegates to storage wipe.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Auth0/CredentialsManager.swift

+    /// Clears all credentials stored in the Keychain, including the main credentials and any API credentials
+    /// for all audiences.
+    ///
+    /// ## Usage
+    ///
+    /// ```swift
+    /// try credentialsManager.clearAll()
+    /// ```
+    ///
+    /// - Throws: An error when the delete operation fails.
+    public func clearAll() throws {
+        #if WEB_AUTH_PLATFORM
+        self.biometricSession.lock.lock()
+        self.biometricSession.lastBiometricAuthTime = self.biometricSession.noSession
+        self.biometricSession.lock.unlock()
+        #endif
+        try self.storage.deleteAllEntries()


Auth0/CredentialsStorage.swift

    /// - Returns: If the entry was deleted.
    func deleteEntry(forKey key: String) -> Bool

+    /// Deletes all storage entries.


V3_MIGRATION_GUIDE.md

+
+**New method:** `clearAll() throws` has been added to `CredentialsManager`.
+
+This method removes **all** credentials stored by the Credentials Manager from the Keychain, including the default credentials entry, any API credentials stored via `store(apiCredentials:)`, and any SSO credentials. It also resets the biometric authentication session (if biometric authentication was enabled).


sanchitmehtagit

Changes look good however, We should test following flows if not tested already

Happy Case: We have only credentials and no APICredentials and then it calls clearAll() API, and then it calls retrieveCredentials(scope) does it throw the correct error?
MRRT flow and calling clear All and then we call following apis

apiCredentials(forAudience) API, does it throw correct error.
store(apiCredentials) , whats behavior in this

V3_MIGRATION_GUIDE.md

NandanPrabhu · 2026-03-16T07:07:56Z

V3_MIGRATION_GUIDE.md

+
+```swift
+// v2 - CredentialsStorage protocol
+class MyCustomStorage: CredentialsStorage {


MyCustomCredentialStorage

renamed MyCustomStorage to MyCustomCredentialStorage

…ialsManager

utkrishtsahu · 2026-03-16T17:44:00Z

Changes look good however, We should test following flows if not tested already

Happy Case: We have only credentials and no APICredentials and then it calls clearAll() API, and then it calls retrieveCredentials(scope) does it throw the correct error?

MRRT flow and calling clear All and then we call following apis

apiCredentials(forAudience) API, does it throw correct error.

store(apiCredentials) , whats behavior in this

@sanchitmehtagit
Flow 1 (Happy case):
Login → clearAll() → credentials() → Correctly throws .noCredentials

Flow 2 (MRRT + clearAll):

apiCredentials(forAudience:) after clearAll() → Correctly throws .noCredentials error
store(apiCredentials:) after clearAll() → Returns true, storage works normally

Console logs confirming all flows:


[Flow 1] clearAll() SUCCESS
[Flow 1] EXPECTED: credentials() threw error: No credentials were found in the store.
[Flow 1] PASS - Correctly received error after clearAll()

[Flow 2] EXPECTED: apiCredentials() threw error: No credentials were found in the store.
[Flow 2] PASS - Correctly received error after clearAll()
[Flow 2] store(apiCredentials:) after clearAll = true
[Flow 2] PASS - Can store new API credentials after clearAll()

sanchitmehtagit

LGTM,
nit:lets add default implementation for deleteAllEntries() API with assertion as discussed for better DX and making it non breaking change

…better DX

sanchitmehtagit

LGTM with 1 nit

V3_MIGRATION_GUIDE.md

…uired when using clearAll()

feat: add clearAll() API to CredentialsManager and deleteAllEntries()…

b66018c

… to CredentialsStore

utkrishtsahu requested a review from a team as a code owner March 13, 2026 03:49

utkrishtsahu changed the title ~~feat: add clearAll() API to CredentialsManager and deleteAllEntries() to CredentialsStore~~ feat: add clearAll() API to CredentialsManager Mar 13, 2026

utkrishtsahu changed the title ~~feat: add clearAll() API to CredentialsManager~~ feat: add clearAll() API to CredentialsManager and deleteAllEntries() method CredentialsStorage Mar 13, 2026

Merge branch 'develop/v3.0' into SDK-7983-Add-clearAll-API-to-Credent…

fab297c

…ialsManager

pmathew92 requested a review from Copilot March 13, 2026 05:48

Copilot started reviewing on behalf of pmathew92 March 13, 2026 05:55 View session

Copilot AI reviewed Mar 13, 2026

View reviewed changes

sanchitmehtagit added Swift v3.0 This label depicts this feature is part of Swift 3.0 review:small Small review labels Mar 13, 2026

sanchitmehtagit reviewed Mar 16, 2026

View reviewed changes

V3_MIGRATION_GUIDE.md Show resolved Hide resolved

NandanPrabhu reviewed Mar 16, 2026

View reviewed changes

utkrishtsahu added 2 commits March 16, 2026 23:05

fix: address PR review comments for clearAll API

902c5df

Merge branch 'develop/v3.0' into SDK-7983-Add-clearAll-API-to-Credent…

9d056b7

…ialsManager

sanchitmehtagit previously approved these changes Mar 17, 2026

View reviewed changes

add default implementation for deleteAllEntries() with assertion for …

c8a733b

…better DX

utkrishtsahu dismissed sanchitmehtagit’s stale review via c8a733b March 23, 2026 18:13

sanchitmehtagit previously approved these changes Mar 24, 2026

View reviewed changes

V3_MIGRATION_GUIDE.md Outdated Show resolved Hide resolved

fix: update migration guide to clarify deleteAllEntries() is only req…

388dfcc

…uired when using clearAll()

utkrishtsahu dismissed sanchitmehtagit’s stale review via 388dfcc March 24, 2026 04:43

sanchitmehtagit approved these changes Mar 24, 2026

View reviewed changes

utkrishtsahu merged commit 26dc2b1 into develop/v3.0 Mar 24, 2026
16 of 18 checks passed

utkrishtsahu deleted the SDK-7983-Add-clearAll-API-to-CredentialsManager branch March 24, 2026 04:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add clearAll() API to CredentialsManager and deleteAllEntries() method CredentialsStorage#1116

feat: add clearAll() API to CredentialsManager and deleteAllEntries() method CredentialsStorage#1116
utkrishtsahu merged 6 commits intodevelop/v3.0from
SDK-7983-Add-clearAll-API-to-CredentialsManager

utkrishtsahu commented Mar 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

sanchitmehtagit left a comment •

edited

Loading

Uh oh!

Uh oh!

NandanPrabhu Mar 16, 2026

Uh oh!

utkrishtsahu Mar 16, 2026

Uh oh!

utkrishtsahu commented Mar 16, 2026

Uh oh!

sanchitmehtagit left a comment •

edited

Loading

Uh oh!

sanchitmehtagit left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants


		New method: `clearAll() throws` has been added to `CredentialsManager`.

		This method removes all credentials stored by the Credentials Manager from the Keychain, including the default credentials entry, any API credentials stored via `store(apiCredentials:)`, and any SSO credentials. It also resets the biometric authentication session (if biometric authentication was enabled).

Conversation

utkrishtsahu commented Mar 13, 2026

📋 Changes

📎 References

🎯 Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

sanchitmehtagit left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

NandanPrabhu Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

utkrishtsahu Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

utkrishtsahu commented Mar 16, 2026

Uh oh!

sanchitmehtagit left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sanchitmehtagit left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

sanchitmehtagit left a comment •

edited

Loading

sanchitmehtagit left a comment •

edited

Loading

sanchitmehtagit left a comment •

edited

Loading