CuongThai iOS

01The server is the source of truth for access and paid plans

Problem

Trusting a client-reported Pro status invites users to patch the app to unlock it.

Decision

The app always asks the server; every Pro gate is enforced on the backend and the app only displays what the server returns. A plan bought on the web therefore works in the app immediately.

Trade-off

Some screens need the network to know access rights.

02Verifying App Store transactions up to Apple’s root certificate

Problem

StoreKit transactions are JWS carrying their own certificate chain. Verifying with the certificate inside the payload is a trap: an attacker self-signs a “bought 12 months” transaction and the code still says valid.

Decision

The backend cryptographically verifies leaf ← intermediate ← root, requires the root to match the pinned SHA-256 fingerprint of Apple Root CA – G3 (never taken from the payload), checks validity periods, and only then the signature.

Trade-off

When Apple rotates its root, the pinned fingerprint must be updated.

03App Store compliance built in before submission

Problem

The first version had placeholder screens, uploads that posted a fake URL, tokens in UserDefaults, a music module pulling audio from YouTube and a shop surface — all grounds for rejection.

Decision

Added Sign in with Apple, in-app account deletion, report/hide/block and a rules-consent screen; removed the music module and shop; built out the placeholder screens and real image upload; moved tokens to Keychain with a one-time migration for older installs.

Trade-off

The app has fewer features than the web where the rules do not allow them.

04An Xcode project generated from configuration

Problem

Xcode project files are hard to read and conflict easily under concurrent changes.

Decision

Targets, packages and settings are described in project.yml and the project is generated with XcodeGen.

Trade-off

New Swift files require re-running generation; forgetting shows up as “symbol not found”.

Swallowed decoding errors: an empty profile instead of an error

What happened

Some screens showed empty data although the API returned everything.

Root cause

The JSON decoder used the default date strategy, so declaring a Date failed the whole decode; and `let` properties with a default value are silently skipped by Codable.

Fix & safeguard

API dates are declared as strings and parsed explicitly; API model fields are `var` and optional. Written down as project rules.

AI-drawn strokes present in the drawing but invisible on a real iPad

28/09/2026

What happened

Shapes the AI drew into a notebook did not appear on a real iPad.

Root cause

Stroke points of 1.2pt with pen ink — PencilKit on a real iPad renders nothing; point size is not pen width.

Fix & safeguard

Point size now follows the user’s sample stroke and never drops below 2.4pt. Lesson: test on real hardware.

Two sheets on one screen: one button silently did nothing

What happened

A button meant to open a sheet did nothing, with no error.

Root cause

SwiftUI only runs the last `.sheet(isPresented:)` when two are attached to the same view.

Fix & safeguard

Each screen uses a single `.sheet(item:)` driven by an enum.