Feature/#64 - 온보딩 Touch ID 인증 및 iCloud 동기화 연동

.mise.toml

@@ -1,2 +1,6 @@
 [tools]
 tuist = "4.191.0"
+
+# 이 저장소 안에서만 scripts/의 명령을 접두사 없이 실행할 수 있게 한다. (예: generate-local)
+[env]
+_.path = ["{{config_root}}/scripts"]

Projects/DVCore/Sources/ICloudContainer.swift

@@ -0,0 +1,7 @@
+// Copyright © 2026 Devault. All rights reserved
+
+/// Devault.entitlements에 등록된 iCloud(CloudKit) 컨테이너 식별자.
+/// entitlements 파일 자체는 plist라 이 상수를 참조할 수 없으니, 값을 바꿀 땐 함께 맞춰줘야 한다.
+public enum ICloudContainer {
+    public static let identifier = "iCloud.com.devault.app"
+}

Projects/DVCore/Sources/Logger/DVLogger.swift

@@ -52,56 +52,56 @@ public protocol DVLogger {
     static var defaultCategory: LogCategory { get }
 }
 
-public extension DVLogger {
-    static var defaultCategory: LogCategory { .general }
+extension DVLogger {
+    public static var defaultCategory: LogCategory { .general }
 }
 
 // MARK: - Level Methods
 
-public extension DVLogger {
+extension DVLogger {
     /// 상세 디버그 로그. Debug 빌드 전용.
-    static func debug(_ message: @autoclosure () -> String, category: LogCategory? = nil,
+    public static func debug(_ message: @autoclosure () -> String, category: LogCategory? = nil,
                       file: String = #fileID, function: String = #function, line: Int = #line) {
         #if DEBUG
         emit(.debug, "⚪️", message(), category ?? defaultCategory, file, function, line)
         #endif
     }
 
     /// 일반 정보 로그. Debug 빌드 전용.
-    static func info(_ message: @autoclosure () -> String, category: LogCategory? = nil,
+    public static func info(_ message: @autoclosure () -> String, category: LogCategory? = nil,
                      file: String = #fileID, function: String = #function, line: Int = #line) {
         #if DEBUG
         emit(.info, "🔵", message(), category ?? defaultCategory, file, function, line)
         #endif
     }
 
     /// 경고 로그. Debug 빌드 전용.
-    static func warn(_ message: @autoclosure () -> String, category: LogCategory? = nil,
+    public static func warn(_ message: @autoclosure () -> String, category: LogCategory? = nil,
                      file: String = #fileID, function: String = #function, line: Int = #line) {
         #if DEBUG
         emit(.default, "🟡", message(), category ?? defaultCategory, file, function, line)
         #endif
     }
 
     /// 에러 로그. 항상 기록되며 Release 에선 마스킹된다.
-    static func error(_ message: @autoclosure () -> String, category: LogCategory? = nil,
+    public static func error(_ message: @autoclosure () -> String, category: LogCategory? = nil,
                       file: String = #fileID, function: String = #function, line: Int = #line) {
         emit(.error, "🔴", message(), category ?? defaultCategory, file, function, line)
     }
 
     /// 치명적 에러 로그. 항상 기록되며 Release 에선 마스킹된다.
-    static func critical(_ message: @autoclosure () -> String, category: LogCategory? = nil,
+    public static func critical(_ message: @autoclosure () -> String, category: LogCategory? = nil,
                          file: String = #fileID, function: String = #function, line: Int = #line) {
         emit(.fault, "🟣", message(), category ?? defaultCategory, file, function, line)
     }
 }
 
 // MARK: - measure
 
-public extension DVLogger {
+extension DVLogger {
     /// 동기 블록의 실행 시간을 `⏱ … - 12.34ms` 로 로깅한다. Release 에선 측정 없이 실행만 한다.
     @discardableResult
-    static func measure<T>(_ label: String, category: LogCategory? = nil,
+    public static func measure<T>(_ label: String, category: LogCategory? = nil,
                            file: String = #fileID, function: String = #function, line: Int = #line,
                            _ work: () throws -> T) rethrows -> T {
         #if DEBUG
@@ -117,7 +117,7 @@ public extension DVLogger {
 
     /// ``measure(_:category:file:function:line:_:)`` 의 async 버전.
     @discardableResult
-    static func measure<T>(_ label: String, category: LogCategory? = nil,
+    public static func measure<T>(_ label: String, category: LogCategory? = nil,
                            file: String = #fileID, function: String = #function, line: Int = #line,
                            _ work: () async throws -> T) async rethrows -> T {
         #if DEBUG

Projects/DVData/Sources/RepositoryImpl/Secret/SecretFetchDescriptorBuilder.swift

@@ -118,9 +118,9 @@ enum SecretFetchDescriptorBuilder {
         case let .project(projectID):
             return #Predicate<SwiftDataModel.Secret> { secret in
                 secret.deletedAt == nil &&
-                secret.projectLinks.contains { link in
-                    link.project.id == projectID
-                } &&
+                secret.projectLinks?.contains { link in
+                    link.projectID == projectID
+                } == true &&
                 (!hasSecretType || secret.secretType == secretType) &&
                 (!hasService || secret.service == service) &&
                 (!hasEnvironment || secret.environment == environment)

Projects/DVData/Sources/RepositoryImpl/Secret/SecretRepositoryImpl.swift

@@ -78,7 +78,16 @@ public actor SecretRepositoryImpl: SecretRepository {
         do {
             let descriptor = SecretFetchDescriptorBuilder.make(from: query)
             let localSecrets = try modelContext.fetch(descriptor)
-            let domainSecrets = try localSecrets.map { try $0.toDomain() }
+            let domainSecrets = localSecrets.compactMap { localSecret -> DVDomain.Secret? in
+                do {
+                    return try localSecret.toDomain()
+                } catch {
+                    // CloudKit 동기화 지연 등으로 payload가 아직 도착하지 않았을 수 있어 목록에서만 건너뜀
+                    // 반복적으로 찍히면 진짜 손상된 레코드일 수 있으니 확인 필요
+                    Log.warn("Secret(\(localSecret.id)) 변환 실패, 목록에서 제외: \(error)", category: .storage)
+                    return nil
+                }
+            }
             return InMemorySecretQueryFilter.apply(query, to: domainSecrets)
         } catch let error as SecretRepositoryError {
             throw error
@@ -282,7 +291,7 @@ public actor SecretRepositoryImpl: SecretRepository {
 
             apply(patch, to: localSecret)
 
-            let currentIDs = Set(localSecret.projects.map(\.id))
+            let currentIDs = Set((localSecret.projectLinks ?? []).map(\.projectID))
             let desiredIDs = Set(projectIDs)
 
             for projectID in desiredIDs.subtracting(currentIDs) {

Projects/DVData/Sources/RepositoryImpl/Settings/SettingsRepositoryImpl.swift

@@ -7,16 +7,31 @@ import DVDomain
 public struct SettingsRepositoryImpl: SettingsRepository, @unchecked Sendable {
 
   private let defaults: UserDefaults
+  private let ubiquitousStore: NSUbiquitousKeyValueStore
 
-  public init(defaults: UserDefaults = .standard) {
+  public init(
+    defaults: UserDefaults = .standard,
+    ubiquitousStore: NSUbiquitousKeyValueStore = .default
+  ) {
     self.defaults = defaults
+    self.ubiquitousStore = ubiquitousStore
   }
 
+  // hasCompletedOnboarding은 기기별로 Touch ID 확인이 필요하므로 로컬 UserDefaults로 관리
   public func hasCompletedOnboarding() -> Bool {
     defaults.bool(forKey: .hasCompletedOnboarding)
   }
 
   public func setOnboardingCompleted() {
     defaults.set(true, forKey: .hasCompletedOnboarding)
   }
+
+  // iCloud 동기화 사용 여부는 독립적으로 켜야 하므로 로컬 UserDefaults로 관리
+  public func isICloudSyncEnabled() -> Bool {
+    defaults.bool(forKey: .isICloudSyncEnabled)
+  }
+
+  public func setICloudSyncEnabled(_ enabled: Bool) {
+    defaults.set(enabled, forKey: .isICloudSyncEnabled)
+  }
 }

Projects/DVData/Sources/RepositoryImpl/Settings/UbiquitousStoreKey.swift

@@ -0,0 +1,16 @@
+// Copyright © 2026 Devault. All rights reserved
+
+import Foundation
+
+// 기기 간 동기화가 필요한 설정이 생기면 여기에 케이스를 추가한다.
+//enum UbiquitousStoreKey: String {}
+//
+//extension NSUbiquitousKeyValueStore {
+//  func bool(forKey key: UbiquitousStoreKey) -> Bool {
+//    bool(forKey: key.rawValue)
+//  }
+//
+//  func set(_ value: Bool, forKey key: UbiquitousStoreKey) {
+//    set(value, forKey: key.rawValue)
+//  }
+//}

Projects/DVData/Sources/RepositoryImpl/Settings/UserDefaultsKey.swift

@@ -4,6 +4,7 @@ import Foundation
 
 enum UserDefaultsKey: String {
   case hasCompletedOnboarding
+  case isICloudSyncEnabled
 }
 
 extension UserDefaults {

Projects/DVData/Sources/ServiceImpl/ICloudSync/CloudKitAccountServiceImpl.swift

@@ -0,0 +1,49 @@
+// Copyright © 2026 Devault. All rights reserved
+
+import CloudKit
+import DVCore
+import DVDomain
+
+public struct CloudKitAccountServiceImpl: ICloudAccountService {
+
+    private let container: CKContainer
+
+    /// - Parameter containerIdentifier: entitlements에 등록된 iCloud 컨테이너 식별자
+    public init(containerIdentifier: String) {
+        self.container = CKContainer(identifier: containerIdentifier)
+    }
+
+    public func fetchAccountStatus() async -> ICloudAccountStatus {
+        do {
+            switch try await container.accountStatus() {
+            case .available:
+                return .available
+            case .noAccount:
+                return .noAccount
+            case .restricted:
+                return .restricted
+            case .temporarilyUnavailable:
+                return .temporarilyUnavailable
+            case .couldNotDetermine:
+                return .couldNotDetermine
+            @unknown default:
+                return .couldNotDetermine
+            }
+        } catch let error as CKError {
+            switch error.code {
+            case .networkUnavailable, .networkFailure:
+                return .networkUnavailable
+            case .notAuthenticated:
+                return .noAccount
+            case .badContainer, .missingEntitlement:
+                // container identifier 오타나 entitlement 누락 등 배포 설정 문제. 재시도로는 해결되지 않으므로 로그 추가
+                Log.error("iCloud 컨테이너 설정 오류: \(error)", category: .security)
+                return .configurationUnavailable
+            default:
+                return .couldNotDetermine
+            }
+        } catch {
+            return .couldNotDetermine
+        }
+    }
+}

Projects/DVData/Sources/ServiceImpl/Security/Keychain/KeychainKeyStore.swift

@@ -7,18 +7,18 @@ import Security
 
 struct KeychainKeyStore: Sendable {
     private let service: String
-    
+
     /// Keychain generic password item을 구분할 service namespace를 설정한다.
     init(service: String) {
         self.service = service
     }
-    
+
     /// tag에 해당하는 symmetric key를 조회하고, 없으면 새 key를 생성해 Keychain에 저장한다.
     func getOrCreateSymmetricKey(tag: String) throws -> SymmetricKey {
         if let existing = try loadKeyData(tag: tag) {
             return SymmetricKey(data: existing)
         }
-        
+
         let generated = try generateKeyData()
         let resolved = try saveOrLoadExistingKeyData(generated, tag: tag)
         return SymmetricKey(data: resolved)
@@ -29,7 +29,7 @@ struct KeychainKeyStore: Sendable {
         guard let data = try loadKeyData(tag: tag) else {
             throw SecretCryptoError.keyUnavailable
         }
-        
+
         return SymmetricKey(data: data)
     }
 }
@@ -38,6 +38,7 @@ extension KeychainKeyStore {
     /// Keychain에서 tag에 해당하는 raw key Data를 조회한다.
     private func loadKeyData(tag: String) throws -> Data? {
         var query = keyQuery(tag: tag)
+        query[kSecAttrSynchronizable] = kSecAttrSynchronizableAny
         let attributes: [CFString: Any] = [
             kSecReturnData: true,
             kSecMatchLimit: kSecMatchLimitOne,
@@ -65,7 +66,8 @@ extension KeychainKeyStore {
 
         let attributes: [CFString: Any] = [
             kSecValueData: data,
-            kSecAttrAccessible: kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+            kSecAttrAccessible: kSecAttrAccessibleWhenUnlocked,
+            kSecAttrSynchronizable: true,
         ]
 
         var addQuery = query
@@ -93,6 +95,7 @@ extension KeychainKeyStore {
             kSecClass: kSecClassGenericPassword,
             kSecAttrService: service,
             kSecAttrAccount: tag,
+            kSecUseDataProtectionKeychain: true,
         ]
     }
 

Projects/DVData/Sources/Storage/Local/LocalStorage.swift

@@ -1,5 +1,6 @@
 // Copyright © 2026 Devault. All rights reserved
 
+import DVCore
 import SwiftData
 
 public final class LocalStorage {
@@ -9,11 +10,22 @@ public final class LocalStorage {
         self.modelContainer = modelContainer
     }
 
-    public static func makeDefault() throws -> LocalStorage {
-        let configuration = ModelConfiguration(isStoredInMemoryOnly: false)
+    public static func makeDefault(iCloudSyncEnabled: Bool) throws -> LocalStorage {
+        let syncedConfiguration = ModelConfiguration(
+            "Synced",
+            schema: Schema.syncedSchema,
+            isStoredInMemoryOnly: false,
+            cloudKitDatabase: iCloudSyncEnabled ? .private(ICloudContainer.identifier) : .none
+        )
+        let localOnlyConfiguration = ModelConfiguration(
+            "LocalOnly",
+            schema: Schema.localOnlySchema,
+            isStoredInMemoryOnly: false,
+            cloudKitDatabase: .none
+        )
         let modelContainer = try ModelContainer(
             for: Schema.appSchema,
-            configurations: configuration
+            configurations: syncedConfiguration, localOnlyConfiguration
         )
 
         return LocalStorage(modelContainer: modelContainer)

Projects/DVData/Sources/Storage/Local/Models/AppAuditLog.swift

@@ -5,10 +5,10 @@ import SwiftData
 
 extension SwiftDataModel {
     @Model final class AppAuditLog {
-        @Attribute(.unique) var id: UUID
-        var eventType: String
-        var actorContext: String
-        var occurredAt: Date
+        var id: UUID = UUID()
+        var eventType: String = ""
+        var actorContext: String = ""
+        var occurredAt: Date = Date()
 
         init(
             id: UUID = UUID(),

Projects/DVData/Sources/Storage/Local/Models/AppSchema.swift

@@ -7,6 +7,24 @@ enum SwiftDataModel { }
 extension Schema {
     private static let schemaVersion: Schema.Version = Version(1, 0, 0)
 
+    /// iCloud와 동기화되는 모델. CloudKit private database로 미러링 됨
+    static let syncedSchema = Schema([
+        SwiftDataModel.Project.self,
+        SwiftDataModel.Secret.self,
+        SwiftDataModel.SecretProjectLink.self,
+        SwiftDataModel.SecretPayload.self,
+        SwiftDataModel.SecretMetadata.self,
+        SwiftDataModel.SecretAuditLog.self,
+        SwiftDataModel.AppAuditLog.self,
+    ], version: schemaVersion)
+
+    /// 기기 로컬에만 저장되는 모델.
+    /// BackupRecord.filePath는 해당 기기의 절대 경로라 다른 기기에서는 의미가 없고,
+    /// 사용자명 등 로컬 경로 정보가 그대로 iCloud에 올라가면 안 되므로 동기화 스코프에서 제외
+    static let localOnlySchema = Schema([
+        SwiftDataModel.BackupRecord.self,
+    ], version: schemaVersion)
+
     static let appSchema = Schema([
         SwiftDataModel.Project.self,
         SwiftDataModel.Secret.self,

Projects/DVData/Sources/Storage/Local/Models/BackupRecord.swift

@@ -5,14 +5,14 @@ import SwiftData
 
 extension SwiftDataModel {
     @Model final class BackupRecord {
-        @Attribute(.unique) var id: UUID
-        var fileName: String
-        var filePath: String
-        var backupScope: String
-        var hasIndependentPassword: Bool
-        var keyTag: String
-        var totalSecrets: Int
-        var createdAt: Date
+        var id: UUID = UUID()
+        var fileName: String = ""
+        var filePath: String = ""
+        var backupScope: String = ""
+        var hasIndependentPassword: Bool = false
+        var keyTag: String = ""
+        var totalSecrets: Int = 0
+        var createdAt: Date = Date()
 
         init(
             id: UUID = UUID(),