[jokerlin]

Problem

Apps that use FirebaseAuth (e.g. Brown Dust 2, com.neowizgames.game.browndust2ios) ask the user to sign in again on every launch when PlayChain is enabled.

FirebaseAuth reads the saved user with kSecMatchLimit = 2 (a CFNumber) plus kSecReturnData and kSecReturnAttributes, and expects a CFArray of attribute dictionaries (AuthKeychainServices.getItem).

PlayKeychain.copyMatching only treats kSecMatchLimitAll as a multi-item query. For a numeric limit it returns a single dictionary with errSecSuccess. Firebase's as? [[String: Any]] cast fails and it throws:

[FirebaseAuth][I-AUT000001] Error loading saved user when starting up:
Error Domain=FIRAuthErrorDomain Code=17995 ... NSLocalizedFailureReason=SecItemCopyMatching (0) No error.

Because the read fails, Firebase also writes a fresh item on each sign-in, so duplicate genp rows pile up in the PlayChain db.

Fix

• kSecMatchLimitAll or a CFNumber limit > 1 now returns a CFArray, truncated to the limit.
  The truncated list goes through the existing copyAllMatches, which already keeps v_Data when kSecReturnData is set.
• The check is a private static method of PlayKeychain (multiMatchLimit), so copyMatching stays within SwiftLint limits.
• Multi-item queries (numeric limit or kSecMatchLimitAll) now also handle existence checks (no kSecReturn* key: status only) and kSecReturnRef (array of SecKey). PlayedApple.swift disables file_length, as PlayAction.swift does.

The hook_setCurrentSubscription: signature change moved to #244.

Testing

• This branch plus build: avoid VSSubscription type unavailable on Mac Catalyst in newer SDKs #244: built with Xcode 27.1 for Mac Catalyst arm64. On the Xcode 27 SDK this branch needs build: avoid VSSubscription type unavailable on Mac Catalyst in newer SDKs #244 to build.
• SwiftLint 0.65.1 --strict: no violations in PlayedApple.swift.
• Unit-checked the helpers in isolation: kSecMatchLimitAll → all, NSNumber 2 → 2, NSNumber 1 / kSecMatchLimitOne / nil → single-item path, result casts to [[String: Any]] with v_Data when r_Data is set.
• On device I tested the same fix (including the multi-item existence and kSecReturnRef handling) ported to the MaaTools fork that my PlayCover build uses (fix(PlayChain): return CFArray for numeric kSecMatchLimit (fixes FirebaseAuth re-login) hguandl/PlayTools#10), on macOS with PlayCover 3.1.0.maa.10 and Brown Dust 2 v2.36.7 / v2.37.13: before the patch every relaunch showed the sign-in screen with the error above. With the patched PlayTools, after one sign-in the game relaunches straight to the title screen with the UID shown, and the Firebase error no longer appears.

[TheMoonThatRises]

Can you move the hook_setCurrentSubscription function signature change into a separate pull request? Also, multiMatchLimit should be a member method of PlayKeychain.

[jokerlin]

@TheMoonThatRises Thank you for the review. multiMatchLimit is now a private static method of PlayKeychain, the hook_setCurrentSubscription: signature change is split out into #244 (needed to build on the Xcode 27 SDK), and 0dc2366 also covers multi-item existence and kSecReturnRef queries; I re-verified the updated build in-game with Brown Dust 2 (v2.37.13), so both #244 and this PR are ready for another look when you have time.