search

braze-inc / braze-swift-sdk

https://www.braze.com
Other
48 stars 19 forks source link

[Bug]: Missing required reason API justification for Notification Content Extension #118

Closed jc-paris closed 3 months ago

jc-paris commented 3 months ago

Platform

iOS

Platform Version

iOS 17

Braze SDK Version

8.2.1

Xcode Version

15.2

Computer Processor

Apple (M1)

Repro Rate

100% of the time

Steps To Reproduce

  1. Create a Notification Content Extension following this tutorial and latest braze SDK: https://braze-inc.github.io/braze-swift-sdk/tutorials/braze/b2-rich-push-notifications/
  2. Submit your app to App Store Connect

You will receive this notice:

ITMS-91053: Missing API declaration - Your app’s code in the “PlugIns/Notification Content Extension.appex/Notification Content Extension” file references one or more APIs that require reasons, including the following API categories: NSPrivacyAccessedAPICategoryUserDefaults. While no action is required at this time, starting May 1, 2024, when you upload a new app or app update, you must include a NSPrivacyAccessedAPITypes array in your app’s privacy manifest to provide approved reasons for these APIs used by your app’s code. For more details about this policy, including a list of required reason APIs and approved reasons for usage, visit: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api.

Expected Behavior

A PrivacyManifest should be included in BrazePushStory to give the require reason for using UserDefaults (which should be 1C8F.1)

Describing use of required reason API

Declare this reason to access user defaults to read and write information that is only accessible to the apps, app extensions, and App Clips that are members of the same App Group as the app itself. This reason does not permit reading information that was written by apps, app extensions, or App Clips outside the same App Group or by the system. Your app is not responsible if the system provides information from the global domain because a key is not present in your requested domain while your app is attempting to read information that apps, app extensions, or App Clips in your app’s App Group write. This reason also does not permit writing information that can be accessed by apps, app extensions, or App Clips outside the same App Group.

Actual Incorrect Behavior

No Privacy Manifest included in the extension resulting in Apple notice and soon refusal to upload build to App Store Connect

Verbose Logs

No response

Additional Information

No response

jerielng commented 3 months ago

Hi @jc-paris, this has been on our radar, and we have resolved it within our internal repository. It should go out with the next release.

To confirm, is this the only error you are seeing on submission to the App Store?

jc-paris commented 3 months ago

Hello @jerielng, thanks for sharing progress ! For now it is the only issue we have. We also defined API reason for our own usage, which overlap with some Braze definition, so I cannot confirm that the Braze file is correctly processed by Apple in other scenario, just that our definition didn't raise any more notice during the submission 👌

jerielng commented 3 months ago

Hey @jc-paris, we've just released version 8.3.0, which should contain a privacy manifest for BrazePushStory. Feel free to re-open this issue if you face any other issues after upgrading. Thanks!

sebastianmraz commented 3 months ago

Having the same issue here

Platform

iOS

Platform Version

iOS 17.2

Braze SDK Version

8.3.0

Xcode Version

15.2

Computer Processor

Apple M1 Pro

Hello,We noticed one or more issues with a recent submission for TestFlight review for the following app:Bistro.skVersion 9.3.1Build 5Although submission for TestFlight review was successful, you may want to correct the following issues in your next submission for TestFlight review. Once you've corrected the issues, upload a new binary to App Store Connect.ITMS-91053: Missing API declaration - Your app’s code in the “PlugIns/BrazeNotificationContent.appex/BrazeNotificationContent” file references one or more APIs that require reasons, including the following API categories: NSPrivacyAccessedAPICategoryUserDefaults. While no action is required at this time, starting May 1, 2024, when you upload a new app or app update, you must include a NSPrivacyAccessedAPITypes array in your app’s privacy manifest to provide approved reasons for these APIs used by your app’s code. For more details about this policy, including a list of required reason APIs and approved reasons for usage, visit: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api.Apple Developer Relations

i have a feeling that this can be connected with the fact that apple is resolving privacy info only for Frameworks, Libraries and embedded content that is linked directly with the application target. Maybe it is not possible to get to that privacy info because BrazePushStory product is only linked to Notification Content Extension target

jerielng commented 3 months ago

Having the same issue here

Hello,We noticed one or more issues with a recent submission for TestFlight review for the following app:Bistro.skVersion 9.3.1Build 5Although submission for TestFlight review was successful, you may want to correct the following issues in your next submission for TestFlight review. Once you've corrected the issues, upload a new binary to App Store Connect.ITMS-91053: Missing API declaration - Your app’s code in the “PlugIns/BrazeNotificationContent.appex/BrazeNotificationContent” file references one or more APIs that require reasons, including the following API categories: NSPrivacyAccessedAPICategoryUserDefaults. While no action is required at this time, starting May 1, 2024, when you upload a new app or app update, you must include a NSPrivacyAccessedAPITypes array in your app’s privacy manifest to provide approved reasons for these APIs used by your app’s code. For more details about this policy, including a list of required reason APIs and approved reasons for usage, visit: https://developer.apple.com/documentation/bundleresources/privacy_manifest_files/describing_use_of_required_reason_api.Apple Developer Relations

Hey @sebastianmraz, are you still facing this in 8.3.0?

sebastianmraz commented 3 months ago

@jerielng hello, yes we are still facing this issue in 8.3.0. I accidentally submitted last message before i managed to provide all the information but it is already edited with all the info

jerielng commented 3 months ago

i have a feeling that this can be connected with the fact that apple is resolving privacy info only for Frameworks, Libraries and embedded content that is linked directly with the application target. Maybe it is not possible to get to that privacy info because BrazePushStory product is only linked to Notification Content Extension target

@sebastianmraz Thanks for clarifying! On this note, we've seen some unexpected behaviors particularly with app extensions and just statically linked frameworks in general. There are a couple of reports like this one that there aren't clear resolutions for at the moment, but we're continuing to keep an eye on it and will post any updates as we have them.

One workaround that we have found to work reliably in the meantime is creating your own app-level manifest that declares the same required reason types.

sebastianmraz commented 3 months ago

Sadly the workaround with declaring our own privacy to cover this did not for us, we have tried to copy everything from BrazePushNotification privacy with no difference in response from apple when we submitted our build.

jerielng commented 3 months ago

@sebastianmraz Do you think you could write in to support@braze.com with more details about your project setup, the more details the better?

Immediately, some things that come to mind are:

And our support team can help take a deeper look into the issue.

sebastianmraz commented 3 months ago

Definitely yes, thanks for your guidance.