Use local config storage and add MIT license

Author: GeekyWizKid

.github/workflows/build.yml

@@ -34,7 +34,7 @@ jobs:
           if [[ "${GITHUB_REF_TYPE:-}" == "tag" ]]; then
             VERSION="$GITHUB_REF_NAME"
           else
-            VERSION="v0.1.3"
+            VERSION="v0.1.4"
           fi
           VERSION="$VERSION" ./scripts/package-release.sh
           VERSION="$VERSION" ./scripts/verify-release.sh

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## v0.1.4
+
+- Removed macOS Keychain token storage.
+- Saved auth and refresh tokens in the local Application Support config file.
+- Simplified config loading so login state is managed from one local JSON file.
+
 ## v0.1.3
 
 - Added GitHub Releases update checking.
@@ -15,7 +21,7 @@
 
 ## v0.1.1
 
-- Moved login tokens to the macOS Keychain with automatic migration from older config files.
+- Added a credential-storage iteration that was superseded by v0.1.4 local config storage.
 - Added a settings action to disconnect and clear saved credentials.
 - Added account identity display and model-usage progress bars.
 - Removed remaining admin-mode client surface from the user-focused app.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 GeekyWizKid
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -10,7 +10,7 @@ Sub2API Status Bar is a macOS menu bar companion for Sub2API users. It keeps dai
 - Seven-day token trend and model distribution
 - Optional menu bar text summary, for example `$120.75 · 1219 req · 3 RPM`
 - First-run login and optional manual Bearer token setup
-- Keychain-backed token storage; no telemetry or third-party analytics
+- Local config storage; no telemetry or third-party analytics
 - GitHub Releases update checking from Settings
 
 ## Requirements
@@ -50,7 +50,7 @@ Non-secret preferences are saved at:
 ~/Library/Application Support/Sub2APIStatusBar/config.json
 ```
 
-Login tokens are stored in the macOS Keychain. Existing config files from older builds are migrated automatically on launch.
+Login tokens are stored in the same local config file. The app does not use macOS Keychain.
 
 To switch accounts or remove saved credentials, open Settings and choose **Disconnect**.
 
@@ -66,7 +66,7 @@ swift run Sub2APIStatusBar
 ## Build A macOS App
 
 ```bash
-VERSION=v0.1.3 ./scripts/build-app.sh
+VERSION=v0.1.4 ./scripts/build-app.sh
 ```
 
 Output:
@@ -79,21 +79,21 @@ The build script generates the app icon, copies bundle resources, and applies ad
 
 ```bash
 SIGN_IDENTITY="Developer ID Application: Your Name (TEAMID)" \
-VERSION=v0.1.3 \
+VERSION=v0.1.4 \
 ./scripts/build-app.sh
 ```
 
 ## Package A Release
 
 ```bash
-VERSION=v0.1.3 ./scripts/package-release.sh
+VERSION=v0.1.4 ./scripts/package-release.sh
 ```
 
 Output:
 
 ```text
-dist/Sub2APIStatusBar-0.1.3-macOS.zip
-dist/Sub2APIStatusBar-0.1.3-macOS.zip.sha256
+dist/Sub2APIStatusBar-0.1.4-macOS.zip
+dist/Sub2APIStatusBar-0.1.4-macOS.zip.sha256
 ```
 
 ## Notarize A Release
@@ -105,7 +105,7 @@ APPLE_ID="you@example.com" \
 TEAM_ID="TEAMID" \
 APP_SPECIFIC_PASSWORD="xxxx-xxxx-xxxx-xxxx" \
 SIGN_IDENTITY="Developer ID Application: Your Name (TEAMID)" \
-VERSION=v0.1.3 \
+VERSION=v0.1.4 \
 ./scripts/notarize-release.sh
 ```
 
@@ -137,7 +137,11 @@ swift run Sub2APIStatusBar
 
 ## Privacy
 
-Sub2API Status Bar stores the server URL, display preferences, and refresh interval in the local Application Support config file. Auth and refresh tokens are stored in the macOS Keychain. It does not send data anywhere except the configured Sub2API server.
+Sub2API Status Bar stores the server URL, auth token, refresh token, display preferences, account list, and refresh interval in the local Application Support config file. It does not use macOS Keychain and does not send data anywhere except the configured Sub2API server.
 
 ## Acknowledgements
 Thanks to the [LinuxDo](https://linux.do/) community for the discussions, sharing, and feedback.
+
+## License
+
+MIT

Sources/Sub2APIStatusCore/AppConfig.swift

@@ -58,17 +58,23 @@ public struct StoredAccount: Codable, Identifiable, Equatable, Sendable {
     public var name: String
     public var email: String
     public var baseURL: String
+    public var authToken: String
+    public var refreshToken: String
 
     public init(
         id: String = UUID().uuidString,
         name: String = "",
         email: String = "",
-        baseURL: String
+        baseURL: String,
+        authToken: String = "",
+        refreshToken: String = ""
     ) {
         self.id = id
         self.name = name
         self.email = email
         self.baseURL = baseURL
+        self.authToken = authToken
+        self.refreshToken = refreshToken
         normalize()
     }
 
@@ -81,6 +87,8 @@ public struct StoredAccount: Codable, Identifiable, Equatable, Sendable {
         name = name.trimmingCharacters(in: .whitespacesAndNewlines)
         email = email.trimmingCharacters(in: .whitespacesAndNewlines)
         baseURL = AppConfig.normalizedBaseURL(baseURL)
+        authToken = authToken.trimmingCharacters(in: .whitespacesAndNewlines)
+        refreshToken = refreshToken.trimmingCharacters(in: .whitespacesAndNewlines)
     }
 
     public var displayName: String {
@@ -99,6 +107,10 @@ public struct StoredAccount: Codable, Identifiable, Equatable, Sendable {
         }
         return baseURL
     }
+
+    public var storedTokens: StoredAuthTokens {
+        StoredAuthTokens(authToken: authToken, refreshToken: refreshToken)
+    }
 }
 
 public struct AppConfig: Codable, Equatable, Sendable {
@@ -164,6 +176,8 @@ public struct AppConfig: Codable, Equatable, Sendable {
     public func encode(to encoder: Encoder) throws {
         var container = encoder.container(keyedBy: CodingKeys.self)
         try container.encode(baseURL, forKey: .baseURL)
+        try container.encode(authToken, forKey: .authToken)
+        try container.encode(refreshToken, forKey: .refreshToken)
         try container.encode(refreshIntervalSeconds, forKey: .refreshIntervalSeconds)
         try container.encode(language, forKey: .language)
         try container.encode(monitorMode, forKey: .monitorMode)
@@ -268,12 +282,18 @@ public struct AppConfig: Codable, Equatable, Sendable {
             accounts[index].name = accountName.isEmpty ? accounts[index].name : accountName
             accounts[index].email = accountEmail
             accounts[index].baseURL = accountBaseURL
+            if let tokens {
+                accounts[index].authToken = tokens.authToken
+                accounts[index].refreshToken = tokens.refreshToken
+            }
             accounts[index].normalize()
         } else {
             var account = StoredAccount(
                 name: accountName.isEmpty ? accountEmail : accountName,
                 email: accountEmail,
-                baseURL: accountBaseURL
+                baseURL: accountBaseURL,
+                authToken: tokens?.authToken ?? "",
+                refreshToken: tokens?.refreshToken ?? ""
             )
             account.normalize()
             accounts.append(account)
@@ -331,34 +351,10 @@ public struct StoredAuthTokens: Equatable, Sendable {
     }
 }
 
-public protocol TokenStore: Sendable {
-    func loadTokens() -> StoredAuthTokens
-    func saveTokens(_ tokens: StoredAuthTokens) throws
-    func loadTokens(for accountID: String) -> StoredAuthTokens
-    func saveTokens(_ tokens: StoredAuthTokens, for accountID: String) throws
-    func deleteTokens(for accountID: String) throws
-}
-
-public extension TokenStore {
-    func loadTokens(for _: String) -> StoredAuthTokens {
-        loadTokens()
-    }
-
-    func saveTokens(_ tokens: StoredAuthTokens, for _: String) throws {
-        try saveTokens(tokens)
-    }
-
-    func deleteTokens(for accountID: String) throws {
-        try saveTokens(StoredAuthTokens(), for: accountID)
-    }
-}
-
 public final class ConfigStore: Sendable {
     private let configURL: URL
-    private let tokenStore: any TokenStore
 
-    public init(configURL: URL? = nil, tokenStore: any TokenStore = KeychainTokenStore()) {
-        self.tokenStore = tokenStore
+    public init(configURL: URL? = nil) {
         if let configURL {
             self.configURL = configURL
             return
@@ -372,59 +368,28 @@ public final class ConfigStore: Sendable {
     }
 
     public func load() -> AppConfig {
-        let legacyKeychainTokens = tokenStore.loadTokens()
         guard let data = try? Data(contentsOf: configURL),
               var decoded = try? JSONDecoder.sub2api.decode(AppConfig.self, from: data) else {
             var defaults = AppConfig.defaults()
             let envTokens = StoredAuthTokens(authToken: defaults.authToken, refreshToken: defaults.refreshToken)
-            if !legacyKeychainTokens.isEmpty {
-                let accountID = defaults.upsertAccount(name: "Default Account", baseURL: defaults.baseURL, tokens: legacyKeychainTokens)
-                do {
-                    try tokenStore.saveTokens(legacyKeychainTokens, for: accountID)
-                    try tokenStore.saveTokens(StoredAuthTokens())
-                    try writeConfig(defaults)
-                } catch {
-                    defaults.authToken = legacyKeychainTokens.authToken
-                    defaults.refreshToken = legacyKeychainTokens.refreshToken
-                }
-            } else if !envTokens.isEmpty {
+            if !envTokens.isEmpty {
                 defaults.upsertAccount(name: "Environment Account", baseURL: defaults.baseURL, tokens: envTokens)
             }
-            defaults.normalize()
             return defaults
         }
 
-        let legacyTokens = StoredAuthTokens(authToken: decoded.authToken, refreshToken: decoded.refreshToken)
+        let topLevelTokens = StoredAuthTokens(authToken: decoded.authToken, refreshToken: decoded.refreshToken)
         decoded.normalize()
-        let migrationTokens = Self.mergedTokens(primary: legacyKeychainTokens, fallback: legacyTokens)
-
-        if decoded.accounts.isEmpty, !migrationTokens.isEmpty {
-            let accountID = decoded.upsertAccount(name: "Default Account", baseURL: decoded.baseURL, tokens: migrationTokens)
-            do {
-                try tokenStore.saveTokens(migrationTokens, for: accountID)
-                try tokenStore.saveTokens(StoredAuthTokens())
-                try writeConfig(decoded)
-            } catch {
-                decoded.authToken = migrationTokens.authToken
-                decoded.refreshToken = migrationTokens.refreshToken
-            }
+
+        if decoded.accounts.isEmpty, !topLevelTokens.isEmpty {
+            decoded.upsertAccount(name: "Default Account", baseURL: decoded.baseURL, tokens: topLevelTokens)
             decoded.normalize()
             return decoded
         }
 
         if let selectedAccountID = decoded.selectedAccountID {
-            let accountTokens = tokenStore.loadTokens(for: selectedAccountID)
-            let runtimeTokens = Self.mergedTokens(primary: accountTokens, fallback: migrationTokens)
-            decoded.selectAccount(id: selectedAccountID, tokens: runtimeTokens)
-
-            if accountTokens.isEmpty, !runtimeTokens.isEmpty {
-                try? tokenStore.saveTokens(runtimeTokens, for: selectedAccountID)
-                try? tokenStore.saveTokens(StoredAuthTokens())
-            }
-
-            if !legacyTokens.isEmpty {
-                try? writeConfig(decoded)
-            }
+            let tokens = loadTokens(in: decoded, for: selectedAccountID)
+            decoded.selectAccount(id: selectedAccountID, tokens: tokens)
         } else {
             decoded.clearAuthTokens()
         }
@@ -443,18 +408,23 @@ public final class ConfigStore: Sendable {
         }
 
         if let accountID = normalized.selectedAccountID {
-            try tokenStore.saveTokens(tokens, for: accountID)
+            saveTokens(tokens, in: &normalized, for: accountID)
         }
-        try tokenStore.saveTokens(StoredAuthTokens())
         try writeConfig(normalized)
     }
 
     public func loadTokens(for accountID: String) -> StoredAuthTokens {
-        tokenStore.loadTokens(for: accountID)
+        let config = load()
+        return loadTokens(in: config, for: accountID)
     }
 
     public func deleteTokens(for accountID: String) throws {
-        try tokenStore.deleteTokens(for: accountID)
+        var config = load()
+        saveTokens(StoredAuthTokens(), in: &config, for: accountID)
+        if config.selectedAccountID == accountID {
+            config.clearAuthTokens()
+        }
+        try writeConfig(config)
     }
 
     private func writeConfig(_ config: AppConfig) throws {
@@ -466,10 +436,16 @@ public final class ConfigStore: Sendable {
         try encoder.encode(normalized).write(to: configURL, options: .atomic)
     }
 
-    private static func mergedTokens(primary: StoredAuthTokens, fallback: StoredAuthTokens) -> StoredAuthTokens {
-        StoredAuthTokens(
-            authToken: primary.authToken.isEmpty ? fallback.authToken : primary.authToken,
-            refreshToken: primary.refreshToken.isEmpty ? fallback.refreshToken : primary.refreshToken
-        )
+    private func loadTokens(in config: AppConfig, for accountID: String) -> StoredAuthTokens {
+        config.accounts.first { $0.id == accountID }?.storedTokens ?? StoredAuthTokens()
+    }
+
+    private func saveTokens(_ tokens: StoredAuthTokens, in config: inout AppConfig, for accountID: String) {
+        guard let index = config.accounts.firstIndex(where: { $0.id == accountID }) else {
+            return
+        }
+        config.accounts[index].authToken = tokens.authToken
+        config.accounts[index].refreshToken = tokens.refreshToken
+        config.accounts[index].normalize()
     }
 }